@qlever-llc/trellis 0.8.3 → 0.9.0-rc.2

package/esm/generated-sdk/auth/types.d.ts

@@ -1,211 +1,331 @@
 import type { RpcHandlerFn } from "@qlever-llc/trellis";
 import type { API } from "./api.js";
 export declare const CONTRACT_ID: "trellis.auth@v1";
-export declare const CONTRACT_DIGEST: "zNuTif9NvFL58ujjrgEpfJiv9S-kQSuuBSRK8pVWiR8";
-export type AuthApplyDeviceDeploymentContractInput = {
-    contract: {};
-    deploymentId: string;
-    expectedDigest: string;
-    replaceExisting?: boolean;
+export declare const CONTRACT_DIGEST: "LS4TSi9WOfhU3GNszr7fimum7xsF2PhdvLDtsRwpCas";
+export type AuthCapabilitiesListInput = {
+    limit: number;
+    offset?: number;
+};
+export type AuthCapabilitiesListOutput = {
+    count: number;
+    entries: Array<{
+        consequence?: string;
+        contractDigest?: string;
+        contractDisplayName?: string;
+        contractId?: string;
+        description: string;
+        displayName: string;
+        key: string;
+        source: ("contract" | "platform");
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthApplyDeviceDeploymentContractOutput = {
-    contract: {
+export type AuthCapabilityGroupsDeleteInput = {
+    groupKey: string;
+};
+export type AuthCapabilityGroupsDeleteOutput = {
+    success: boolean;
+};
+export type AuthCapabilityGroupsGetInput = {
+    groupKey: string;
+};
+export type AuthCapabilityGroupsGetOutput = {
+    group: {
+        capabilities: Array<string>;
+        createdAt: string;
         description: string;
-        digest: string;
         displayName: string;
-        id: string;
-        installedAt: string;
-    };
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
-        deploymentId: string;
-        disabled: boolean;
-        reviewMode?: ("none" | "required");
+        groupKey: string;
+        includedGroups: Array<string>;
+        updatedAt: string;
     };
 };
-export type AuthApplyServiceDeploymentContractInput = {
-    contract: {};
-    deploymentId: string;
-    expectedDigest: string;
-    replaceExisting?: boolean;
+export type AuthCapabilityGroupsListInput = {
+    limit: number;
+    offset?: number;
 };
-export type AuthApplyServiceDeploymentContractOutput = {
-    contract: {
+export type AuthCapabilityGroupsListOutput = {
+    count: number;
+    entries: Array<{
+        capabilities: Array<string>;
+        createdAt: string;
         description: string;
-        digest: string;
         displayName: string;
-        id: string;
-        installedAt: string;
+        groupKey: string;
+        includedGroups: Array<string>;
+        updatedAt: string;
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
+};
+export type AuthCapabilityGroupsPutInput = {
+    capabilities?: Array<string>;
+    description: string;
+    displayName: string;
+    groupKey: string;
+    includedGroups?: Array<string>;
+};
+export type AuthCapabilityGroupsPutOutput = {
+    group: {
+        capabilities: Array<string>;
+        createdAt: string;
+        description: string;
+        displayName: string;
+        groupKey: string;
+        includedGroups: Array<string>;
+        updatedAt: string;
     };
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
-                        };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
-                        };
-                    };
-                };
-            };
-        }>;
+};
+export type AuthCatalogIssuesResolveInput = {
+    action: ("keep-current" | "force-replace");
+    issueId: string;
+};
+export type AuthCatalogIssuesResolveOutput = {
+    action: ("keep-current" | "force-replace");
+    ignoredEvidence: Array<{
+        contract: {};
+        contractDigest: string;
+        contractId: string;
         deploymentId: string;
-        disabled: boolean;
-        namespaces: Array<string>;
-    };
+        firstSeenAt: string;
+        ignoreReason?: (string | null);
+        ignoredAt?: (string | null);
+        ignoredBy?: ({
+            [k: string]: unknown;
+        } | null);
+        lastSeenAt: string;
+    }>;
+    issueId: string;
+    success: true;
 };
-export type AuthClearDevicePortalSelectionInput = {
-    deploymentId: string;
+export type AuthConnectionsKickInput = {
+    userNkey: string;
 };
-export type AuthClearDevicePortalSelectionOutput = {
+export type AuthConnectionsKickOutput = {
     success: boolean;
 };
-export type AuthClearLoginPortalSelectionInput = {
-    contractId: string;
+export type AuthConnectionsListInput = {
+    limit: number;
+    offset?: number;
+    sessionKey?: string;
+    user?: string;
 };
-export type AuthClearLoginPortalSelectionOutput = {
-    success: boolean;
+export type AuthConnectionsListOutput = {
+    count: number;
+    entries: Array<({
+        clientId: number;
+        connectedAt: string;
+        contractDisplayName: string;
+        contractId: string;
+        key: string;
+        participantKind: "app";
+        principal: {
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            name: string;
+            type: "user";
+            userId: string;
+        };
+        serverId: string;
+        sessionKey: string;
+        userNkey: string;
+    } | {
+        clientId: number;
+        connectedAt: string;
+        contractDisplayName: string;
+        contractId: string;
+        key: string;
+        participantKind: "agent";
+        principal: {
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            name: string;
+            type: "user";
+            userId: string;
+        };
+        serverId: string;
+        sessionKey: string;
+        userNkey: string;
+    } | {
+        clientId: number;
+        connectedAt: string;
+        contractDisplayName?: string;
+        contractId: string;
+        key: string;
+        participantKind: "device";
+        principal: {
+            deploymentId: string;
+            deviceId: string;
+            deviceType: string;
+            runtimePublicKey: string;
+            type: "device";
+        };
+        serverId: string;
+        sessionKey: string;
+        userNkey: string;
+    } | {
+        clientId: number;
+        connectedAt: string;
+        key: string;
+        participantKind: "service";
+        principal: {
+            deploymentId: string;
+            id: string;
+            instanceId: string;
+            name: string;
+            type: "service";
+        };
+        serverId: string;
+        sessionKey: string;
+        userNkey: string;
+    })>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthCreateDeviceDeploymentInput = {
+export type AuthDeploymentsCreateInput = ({
+    deploymentId: string;
+    kind: "service";
+    namespaces: Array<string>;
+} | {
     deploymentId: string;
+    kind: "device";
     reviewMode?: ("none" | "required");
-};
-export type AuthCreateDeviceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
+});
+export type AuthDeploymentsCreateOutput = {
+    deployment: ({
+        deploymentId: string;
+        disabled: boolean;
+        kind: "service";
+        namespaces: Array<string>;
+    } | {
         deploymentId: string;
         disabled: boolean;
+        kind: "device";
         reviewMode?: ("none" | "required");
-    };
+    });
 };
-export type AuthCreatePortalInput = {
-    entryUrl: string;
-    portalId: string;
+export type AuthDeploymentsDisableInput = {
+    deploymentId: string;
+    kind: ("service" | "device");
 };
-export type AuthCreatePortalOutput = {
-    portal: {
+export type AuthDeploymentsDisableOutput = {
+    deployment: ({
+        deploymentId: string;
         disabled: boolean;
-        entryUrl: string;
-        portalId: string;
-    };
+        kind: "service";
+        namespaces: Array<string>;
+    } | {
+        deploymentId: string;
+        disabled: boolean;
+        kind: "device";
+        reviewMode?: ("none" | "required");
+    });
 };
-export type AuthCreateServiceDeploymentInput = {
+export type AuthDeploymentsEnableInput = {
     deploymentId: string;
-    namespaces: Array<string>;
+    kind: ("service" | "device");
 };
-export type AuthCreateServiceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
-                        };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
-                        };
-                    };
-                };
-            };
-        }>;
+export type AuthDeploymentsEnableOutput = {
+    deployment: ({
         deploymentId: string;
         disabled: boolean;
+        kind: "service";
         namespaces: Array<string>;
-    };
+    } | {
+        deploymentId: string;
+        disabled: boolean;
+        kind: "device";
+        reviewMode?: ("none" | "required");
+    });
+};
+export type AuthDeploymentsListInput = {
+    disabled?: boolean;
+    kind?: ("service" | "device");
+    limit: number;
+    offset?: number;
+};
+export type AuthDeploymentsListOutput = {
+    count: number;
+    entries: Array<({
+        deploymentId: string;
+        disabled: boolean;
+        kind: "service";
+        namespaces: Array<string>;
+    } | {
+        deploymentId: string;
+        disabled: boolean;
+        kind: "device";
+        reviewMode?: ("none" | "required");
+    })>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
+};
+export type AuthDeploymentsRemoveInput = {
+    cascade?: boolean;
+    deploymentId: string;
+    kind: ("service" | "device");
+    purgeUnusedContracts?: boolean;
+};
+export type AuthDeploymentsRemoveOutput = {
+    success: boolean;
+};
+export type AuthDeviceUserAuthoritiesListInput = {
+    deploymentId?: string;
+    instanceId?: string;
+    limit: number;
+    offset?: number;
+    state?: ("activated" | "revoked");
+};
+export type AuthDeviceUserAuthoritiesListOutput = {
+    count: number;
+    entries: Array<{
+        activatedAt: string;
+        activatedBy?: {
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            participantKind: ("app" | "agent");
+            userId: string;
+        };
+        deploymentId: string;
+        instanceId: string;
+        publicIdentityKey: string;
+        revokedAt: (string | null);
+        state: ("activated" | "revoked");
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthDecideDeviceActivationReviewInput = {
+export type AuthDeviceUserAuthoritiesReviewsDecideInput = {
     decision: ("approve" | "reject");
     reason?: string;
     reviewId: string;
 };
-export type AuthDecideDeviceActivationReviewOutput = {
+export type AuthDeviceUserAuthoritiesReviewsDecideOutput = {
     activation?: {
         activatedAt: string;
         activatedBy?: {
-            id: string;
-            origin: string;
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            participantKind: ("app" | "agent");
+            userId: string;
         };
         deploymentId: string;
         instanceId: string;
@@ -225,24 +345,73 @@ export type AuthDecideDeviceActivationReviewOutput = {
         state: ("pending" | "approved" | "rejected");
     };
 };
-export type AuthDisableDeviceDeploymentInput = {
-    deploymentId: string;
+export type AuthDeviceUserAuthoritiesReviewsListInput = {
+    deploymentId?: string;
+    instanceId?: string;
+    limit: number;
+    offset?: number;
+    state?: ("pending" | "approved" | "rejected");
 };
-export type AuthDisableDeviceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
+export type AuthDeviceUserAuthoritiesReviewsListOutput = {
+    count: number;
+    entries: Array<{
+        decidedAt: (string | null);
         deploymentId: string;
-        disabled: boolean;
-        reviewMode?: ("none" | "required");
+        instanceId: string;
+        publicIdentityKey: string;
+        reason?: string;
+        requestedAt: string;
+        reviewId: string;
+        state: ("pending" | "approved" | "rejected");
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
+};
+export type AuthDeviceUserAuthoritiesRevokeInput = {
+    instanceId: string;
+};
+export type AuthDeviceUserAuthoritiesRevokeOutput = {
+    success: boolean;
+};
+export type AuthDevicesConnectInfoGetInput = {
+    contractDigest: string;
+    iat: number;
+    publicIdentityKey: string;
+    sig: string;
+};
+export type AuthDevicesConnectInfoGetOutput = {
+    connectInfo: {
+        auth: {
+            authority: ("admin_reviewed" | "user_delegated");
+            iatSkewSeconds: number;
+            mode: "device_identity";
+        };
+        contractDigest: string;
+        contractId: string;
+        deploymentId: string;
+        instanceId: string;
+        transport: {
+            sentinel: {
+                jwt: string;
+                seed: string;
+            };
+        };
+        transports: {
+            native?: {
+                natsServers: Array<string>;
+            };
+            websocket?: {
+                natsServers: Array<string>;
+            };
+        };
     };
+    status: "ready";
 };
-export type AuthDisableDeviceInstanceInput = {
+export type AuthDevicesDisableInput = {
     instanceId: string;
 };
-export type AuthDisableDeviceInstanceOutput = {
+export type AuthDevicesDisableOutput = {
     instance: {
         activatedAt: (string | null);
         createdAt: string;
@@ -258,192 +427,60 @@ export type AuthDisableDeviceInstanceOutput = {
         state: ("registered" | "activated" | "revoked" | "disabled");
     };
 };
-export type AuthDisableInstanceGrantPolicyInput = {
-    contractId: string;
+export type AuthDevicesEnableInput = {
+    instanceId: string;
 };
-export type AuthDisableInstanceGrantPolicyOutput = {
-    policy: {
-        allowedOrigins?: Array<string>;
-        contractId: string;
-        createdAt: string;
-        disabled: boolean;
-        impliedCapabilities: Array<string>;
-        source: ({
-            createdBy?: {
-                id: string;
-                origin: string;
-            };
-            kind: "admin_policy";
-            updatedBy?: {
-                id: string;
-                origin: string;
-            };
-        } | {
-            entryUrl: string;
-            kind: "portal_profile";
-            portalId: string;
-        });
-        updatedAt: string;
-    };
-};
-export type AuthDisablePortalInput = {
-    portalId: string;
-};
-export type AuthDisablePortalOutput = {
-    success: boolean;
-};
-export type AuthDisablePortalProfileInput = {
-    portalId: string;
-};
-export type AuthDisablePortalProfileOutput = {
-    profile: {
-        allowedOrigins?: Array<string>;
-        contractId: string;
+export type AuthDevicesEnableOutput = {
+    instance: {
+        activatedAt: (string | null);
         createdAt: string;
-        disabled: boolean;
-        entryUrl: string;
-        impliedCapabilities: Array<string>;
-        portalId: string;
-        updatedAt: string;
-    };
-};
-export type AuthDisableServiceDeploymentInput = {
-    deploymentId: string;
-};
-export type AuthDisableServiceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
-                        };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
-                        };
-                    };
-                };
-            };
-        }>;
+        currentContractDigest?: string;
+        currentContractId?: string;
         deploymentId: string;
-        disabled: boolean;
-        namespaces: Array<string>;
+        instanceId: string;
+        metadata?: {
+            [k: string]: string;
+        };
+        publicIdentityKey: string;
+        revokedAt: (string | null);
+        state: ("registered" | "activated" | "revoked" | "disabled");
     };
 };
-export type AuthDisableServiceInstanceInput = {
-    instanceId: string;
+export type AuthDevicesListInput = {
+    deploymentId?: string;
+    limit: number;
+    offset?: number;
+    state?: ("registered" | "activated" | "revoked" | "disabled");
 };
-export type AuthDisableServiceInstanceOutput = {
-    instance: {
-        capabilities: Array<string>;
+export type AuthDevicesListOutput = {
+    count: number;
+    entries: Array<{
+        activatedAt: (string | null);
         createdAt: string;
         currentContractDigest?: string;
         currentContractId?: string;
         deploymentId: string;
-        disabled: boolean;
         instanceId: string;
-        instanceKey: string;
-        resourceBindings?: {
-            jobs?: {
-                namespace: string;
-                queues: {
-                    [k: string]: {
-                        ackWaitMs: number;
-                        backoffMs: Array<number>;
-                        concurrency: number;
-                        consumerName: string;
-                        defaultDeadlineMs?: number;
-                        dlq: boolean;
-                        logs: boolean;
-                        maxDeliver: number;
-                        payload: {
-                            schema: string;
-                        };
-                        progress: boolean;
-                        publishPrefix: string;
-                        queueType: string;
-                        result?: {
-                            schema: string;
-                        };
-                        workSubject: string;
-                    };
-                };
-                workStream?: string;
-            };
-            kv?: {
-                [k: string]: {
-                    bucket: string;
-                    history: number;
-                    maxValueBytes?: number;
-                    ttlMs: number;
-                };
-            };
-            store?: {
-                [k: string]: {
-                    maxObjectBytes?: number;
-                    maxTotalBytes?: number;
-                    name: string;
-                    ttlMs: number;
-                };
-            };
+        metadata?: {
+            [k: string]: string;
         };
-    };
+        publicIdentityKey: string;
+        revokedAt: (string | null);
+        state: ("registered" | "activated" | "revoked" | "disabled");
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthEnableDeviceDeploymentInput = {
+export type AuthDevicesProvisionInput = {
+    activationKey: string;
     deploymentId: string;
-};
-export type AuthEnableDeviceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
-        deploymentId: string;
-        disabled: boolean;
-        reviewMode?: ("none" | "required");
+    metadata?: {
+        [k: string]: string;
     };
+    publicIdentityKey: string;
 };
-export type AuthEnableDeviceInstanceInput = {
-    instanceId: string;
-};
-export type AuthEnableDeviceInstanceOutput = {
+export type AuthDevicesProvisionOutput = {
     instance: {
         activatedAt: (string | null);
         createdAt: string;
@@ -459,314 +496,1121 @@ export type AuthEnableDeviceInstanceOutput = {
         state: ("registered" | "activated" | "revoked" | "disabled");
     };
 };
-export type AuthEnableServiceDeploymentInput = {
-    deploymentId: string;
+export type AuthDevicesRemoveInput = {
+    instanceId: string;
 };
-export type AuthEnableServiceDeploymentOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
+export type AuthDevicesRemoveOutput = {
+    success: boolean;
+};
+export type AuthEnvelopeExpansionsApproveInput = {
+    reason?: string;
+    requestId: string;
+};
+export type AuthEnvelopeExpansionsApproveOutput = {
+    contractEvidence: {
+        contract: {};
+        contractDigest: string;
+        contractId: string;
+        deploymentId: string;
+        firstSeenAt: string;
+        ignoreReason?: (string | null);
+        ignoredAt?: (string | null);
+        ignoredBy?: ({
+            [k: string]: unknown;
+        } | null);
+        lastSeenAt: string;
+    };
+    delta: {
+        capabilities: Array<string>;
+        contracts: Array<{
             contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
-                        };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
-                        };
-                    };
-                };
-            };
+            required: boolean;
+        }>;
+        resources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+            required: boolean;
+        }>;
+        surfaces: Array<{
+            action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+            contractId: string;
+            kind: ("rpc" | "operation" | "event" | "feed");
+            name: string;
+            required: boolean;
         }>;
+    };
+    envelope: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        createdAt: string;
         deploymentId: string;
         disabled: boolean;
-        namespaces: Array<string>;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
     };
-};
-export type AuthEnableServiceInstanceInput = {
-    instanceId: string;
-};
-export type AuthEnableServiceInstanceOutput = {
-    instance: {
-        capabilities: Array<string>;
+    request: {
+        contract: {};
+        contractDigest: string;
+        contractId: string;
         createdAt: string;
-        currentContractDigest?: string;
-        currentContractId?: string;
+        decidedAt: (string | null);
+        decidedBy: ({
+            [k: string]: unknown;
+        } | null);
+        decisionReason: (string | null);
+        delta: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
         deploymentId: string;
-        disabled: boolean;
-        instanceId: string;
-        instanceKey: string;
-        resourceBindings?: {
-            jobs?: {
-                namespace: string;
-                queues: {
-                    [k: string]: {
-                        ackWaitMs: number;
-                        backoffMs: Array<number>;
-                        concurrency: number;
-                        consumerName: string;
-                        defaultDeadlineMs?: number;
-                        dlq: boolean;
-                        logs: boolean;
-                        maxDeliver: number;
-                        payload: {
-                            schema: string;
-                        };
-                        progress: boolean;
-                        publishPrefix: string;
-                        queueType: string;
-                        result?: {
-                            schema: string;
-                        };
-                        workSubject: string;
-                    };
-                };
-                workStream?: string;
-            };
-            kv?: {
-                [k: string]: {
-                    bucket: string;
-                    history: number;
-                    maxValueBytes?: number;
-                    ttlMs: number;
-                };
-            };
-            store?: {
-                [k: string]: {
-                    maxObjectBytes?: number;
-                    maxTotalBytes?: number;
-                    name: string;
-                    ttlMs: number;
-                };
-            };
+        requestId: string;
+        requestedBy: {
+            [k: string]: unknown;
         };
+        requestedByKind: ("service" | "device" | "user" | "admin" | "automation");
+        state: ("pending" | "approved" | "rejected");
     };
+    resourceBindings: Array<{
+        alias: string;
+        binding: {
+            [k: string]: unknown;
+        };
+        createdAt: string;
+        deploymentId: string;
+        kind: ("kv" | "store" | "jobs" | "transfer");
+        limits: ({
+            [k: string]: unknown;
+        } | null);
+        updatedAt: string;
+    }>;
 };
-export type AuthGetDeviceConnectInfoInput = {
-    contractDigest: string;
-    iat: number;
-    publicIdentityKey: string;
-    sig: string;
+export type AuthEnvelopeExpansionsListInput = {
+    deploymentId?: string;
+    limit: number;
+    offset?: number;
+    state?: ("pending" | "approved" | "rejected");
 };
-export type AuthGetDeviceConnectInfoOutput = {
-    connectInfo: {
-        auth: {
-            iatSkewSeconds: number;
-            mode: "device_identity";
-        };
+export type AuthEnvelopeExpansionsListOutput = {
+    count: number;
+    entries: Array<{
+        contract: {};
         contractDigest: string;
         contractId: string;
-        deploymentId: string;
-        instanceId: string;
-        transport: {
-            sentinel: {
-                jwt: string;
-                seed: string;
-            };
+        createdAt: string;
+        decidedAt: (string | null);
+        decidedBy: ({
+            [k: string]: unknown;
+        } | null);
+        decisionReason: (string | null);
+        delta: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
         };
-        transports: {
-            native?: {
-                natsServers: Array<string>;
-            };
-            websocket?: {
-                natsServers: Array<string>;
-            };
+        deploymentId: string;
+        requestId: string;
+        requestedBy: {
+            [k: string]: unknown;
         };
-    };
-    status: "ready";
+        requestedByKind: ("service" | "device" | "user" | "admin" | "automation");
+        state: ("pending" | "approved" | "rejected");
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthGetDevicePortalDefaultInput = {};
-export type AuthGetDevicePortalDefaultOutput = {
-    defaultPortal: {
-        portalId: (string | null);
+export type AuthEnvelopeExpansionsRejectInput = {
+    reason?: string;
+    requestId: string;
+};
+export type AuthEnvelopeExpansionsRejectOutput = {
+    request: {
+        contract: {};
+        contractDigest: string;
+        contractId: string;
+        createdAt: string;
+        decidedAt: (string | null);
+        decidedBy: ({
+            [k: string]: unknown;
+        } | null);
+        decisionReason: (string | null);
+        delta: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        deploymentId: string;
+        requestId: string;
+        requestedBy: {
+            [k: string]: unknown;
+        };
+        requestedByKind: ("service" | "device" | "user" | "admin" | "automation");
+        state: ("pending" | "approved" | "rejected");
     };
 };
-export type AuthGetInstalledContractInput = {
-    digest: string;
+export type AuthEnvelopesChangesPreviewInput = {
+    deploymentId: string;
+    proposedBoundary: {
+        capabilities: Array<string>;
+        contracts: Array<{
+            contractId: string;
+            required: boolean;
+        }>;
+        resources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+            required: boolean;
+        }>;
+        surfaces: Array<{
+            action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+            contractId: string;
+            kind: ("rpc" | "operation" | "event" | "feed");
+            name: string;
+            required: boolean;
+        }>;
+    };
 };
-export type AuthGetInstalledContractOutput = {
-    contract: {
-        analysis?: {
-            events: {
-                events: Array<{
-                    key: string;
-                    publishCapabilities: Array<string>;
-                    subject: string;
-                    subscribeCapabilities: Array<string>;
-                    wildcardSubject: string;
+export type AuthEnvelopesChangesPreviewOutput = {
+    current: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
+    };
+    impact: {
+        impactedDeviceSessions: Array<{
+            contractDigest: (string | null);
+            contractId: (string | null);
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
                 }>;
-            };
-            namespaces: Array<string>;
-            nats: {
-                publish: Array<{
-                    kind: string;
-                    requiredCapabilities: Array<string>;
-                    subject: string;
-                    wildcardSubject: string;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
                 }>;
-                subscribe: Array<{
-                    kind: string;
-                    requiredCapabilities: Array<string>;
-                    subject: string;
-                    wildcardSubject: string;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
                 }>;
             };
-            operations: {
-                control: Array<{
-                    action: ("get" | "wait" | "watch" | "cancel");
-                    key: string;
-                    requiredCapabilities: Array<string>;
-                    subject: string;
-                    wildcardSubject: string;
+            sessionKey: string;
+            type: (("app" | "agent") | "device" | "service");
+        }>;
+        impactedIdentityEnvelopes: Array<{
+            identityAnchor: ({
+                contractId: string;
+                kind: "web";
+                origin: string;
+            } | {
+                contractId: string;
+                kind: "cli";
+                sessionPublicKey: string;
+            } | {
+                contractId: string;
+                kind: "native";
+                sessionPublicKey: string;
+            } | {
+                contractId: string;
+                devicePublicKey: string;
+                kind: "device-user";
+            });
+            identityEnvelopeId: string;
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
                 }>;
-                operations: Array<{
-                    callCapabilities: Array<string>;
-                    cancel: boolean;
-                    cancelCapabilities: Array<string>;
-                    controlSubject: string;
-                    key: string;
-                    readCapabilities: Array<string>;
-                    subject: string;
-                    wildcardControlSubject: string;
-                    wildcardSubject: string;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
                 }>;
             };
-            resources: {
-                jobs: Array<{
-                    ackWaitMs: number;
-                    backoffMs: Array<number>;
-                    concurrency: number;
-                    defaultDeadlineMs?: number;
-                    dlq: boolean;
-                    logs: boolean;
-                    maxDeliver: number;
-                    payload: {
-                        schema: string;
-                    };
-                    progress: boolean;
-                    queueType: string;
-                    result?: {
-                        schema: string;
-                    };
+        }>;
+        impactedPendingRequests: Array<{
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
                 }>;
-                kv: Array<{
+                resources: Array<{
                     alias: string;
-                    history: number;
-                    maxValueBytes?: number;
-                    purpose: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
                     required: boolean;
-                    ttlMs: number;
                 }>;
-                store: Array<{
-                    alias: string;
-                    maxObjectBytes?: number;
-                    maxTotalBytes?: number;
-                    purpose: string;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
                     required: boolean;
-                    ttlMs: number;
                 }>;
             };
-            rpc: {
-                methods: Array<{
-                    callerCapabilities: Array<string>;
-                    key: string;
-                    subject: string;
-                    wildcardSubject: string;
+            requestId: string;
+        }>;
+        impactedServiceInstances: Array<{
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
                 }>;
             };
-            subjects?: {
-                subjects: Array<{
-                    key: string;
-                    publishCapabilities: Array<string>;
-                    subject: string;
-                    subscribeCapabilities: Array<string>;
+        }>;
+        impactedSessions: Array<{
+            contractDigest: (string | null);
+            contractId: (string | null);
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
                 }>;
             };
+            sessionKey: string;
+            type: (("app" | "agent") | "device" | "service");
+        }>;
+        orphanedResources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+        }>;
+        removed: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
         };
-        analysisSummary?: {
-            events: number;
-            jobsQueues: number;
-            kvResources: number;
-            namespaces: Array<string>;
-            natsPublish: number;
-            natsSubscribe: number;
-            operationControls: number;
-            operations: number;
-            rpcMethods: number;
-            storeResources: number;
+    };
+    proposed: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
         };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
+    };
+};
+export type AuthEnvelopesExpandInput = {
+    contract: {};
+    deploymentId: string;
+    expectedDigest: string;
+};
+export type AuthEnvelopesExpandOutput = {
+    contractEvidence: {
         contract: {};
-        description: string;
-        digest: string;
-        displayName: string;
-        id: string;
-        installedAt: string;
-        resources?: {
-            kv?: {
-                [k: string]: {
-                    history?: number;
-                    maxValueBytes?: number;
-                    purpose: string;
-                    required?: boolean;
-                    schema: {
-                        schema: string;
-                    };
-                    ttlMs?: number;
-                };
-            };
-            store?: {
-                [k: string]: {
-                    maxObjectBytes?: number;
-                    maxTotalBytes?: number;
-                    purpose: string;
-                    required?: boolean;
-                    ttlMs?: number;
-                };
-            };
+        contractDigest: string;
+        contractId: string;
+        deploymentId: string;
+        firstSeenAt: string;
+        ignoreReason?: (string | null);
+        ignoredAt?: (string | null);
+        ignoredBy?: ({
+            [k: string]: unknown;
+        } | null);
+        lastSeenAt: string;
+    };
+    delta: {
+        capabilities: Array<string>;
+        contracts: Array<{
+            contractId: string;
+            required: boolean;
+        }>;
+        resources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+            required: boolean;
+        }>;
+        surfaces: Array<{
+            action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+            contractId: string;
+            kind: ("rpc" | "operation" | "event" | "feed");
+            name: string;
+            required: boolean;
+        }>;
+    };
+    envelope: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
         };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
     };
+    resourceBindings: Array<{
+        alias: string;
+        binding: {
+            [k: string]: unknown;
+        };
+        createdAt: string;
+        deploymentId: string;
+        kind: ("kv" | "store" | "jobs" | "transfer");
+        limits: ({
+            [k: string]: unknown;
+        } | null);
+        updatedAt: string;
+    }>;
 };
-export type AuthGetLoginPortalDefaultInput = {};
-export type AuthGetLoginPortalDefaultOutput = {
-    defaultPortal: {
+export type AuthEnvelopesGetInput = {
+    deploymentId: string;
+};
+export type AuthEnvelopesGetOutput = {
+    contractEvidence: Array<{
+        contract: {};
+        contractDigest: string;
+        contractId: string;
+        deploymentId: string;
+        firstSeenAt: string;
+        ignoreReason?: (string | null);
+        ignoredAt?: (string | null);
+        ignoredBy?: ({
+            [k: string]: unknown;
+        } | null);
+        lastSeenAt: string;
+    }>;
+    envelope: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
+    };
+    expansionRequests: Array<{
+        contract: {};
+        contractDigest: string;
+        contractId: string;
+        createdAt: string;
+        decidedAt: (string | null);
+        decidedBy: ({
+            [k: string]: unknown;
+        } | null);
+        decisionReason: (string | null);
+        delta: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        deploymentId: string;
+        requestId: string;
+        requestedBy: {
+            [k: string]: unknown;
+        };
+        requestedByKind: ("service" | "device" | "user" | "admin" | "automation");
+        state: ("pending" | "approved" | "rejected");
+    }>;
+    grantOverrides: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+    portalRoute: ({
+        deploymentId: string;
+        disabled: boolean;
+        entryUrl: (string | null);
         portalId: (string | null);
+        updatedAt: string;
+    } | null);
+    resourceBindings: Array<{
+        alias: string;
+        binding: {
+            [k: string]: unknown;
+        };
+        createdAt: string;
+        deploymentId: string;
+        kind: ("kv" | "store" | "jobs" | "transfer");
+        limits: ({
+            [k: string]: unknown;
+        } | null);
+        updatedAt: string;
+    }>;
+};
+export type AuthEnvelopesGrantOverridesListInput = {
+    limit: number;
+    offset?: number;
+};
+export type AuthEnvelopesGrantOverridesListOutput = {
+    count: number;
+    entries: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
+};
+export type AuthEnvelopesGrantOverridesPutInput = {
+    deploymentId: string;
+    overrides: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+};
+export type AuthEnvelopesGrantOverridesPutOutput = {
+    grantOverrides: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+};
+export type AuthEnvelopesGrantOverridesRemoveInput = {
+    deploymentId: string;
+    overrides: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+};
+export type AuthEnvelopesGrantOverridesRemoveOutput = {
+    grantOverrides: Array<({
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "web";
+        origin: string;
+        sessionPublicKey: null;
+    } | {
+        capability: string;
+        capabilityGroupKey: null;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    } | {
+        capability: null;
+        capabilityGroupKey: string;
+        contractId: string;
+        deploymentId: string;
+        grantKind: "capability-group";
+        identityKind: "session";
+        origin: null;
+        sessionPublicKey: string;
+    })>;
+};
+export type AuthEnvelopesListInput = {
+    disabled?: boolean;
+    kind?: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+    limit: number;
+    offset?: number;
+};
+export type AuthEnvelopesListOutput = {
+    count: number;
+    entries: Array<{
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
+};
+export type AuthEnvelopesShrinkInput = {
+    confirm: boolean;
+    deploymentId: string;
+    proposedBoundary: {
+        capabilities: Array<string>;
+        contracts: Array<{
+            contractId: string;
+            required: boolean;
+        }>;
+        resources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+            required: boolean;
+        }>;
+        surfaces: Array<{
+            action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+            contractId: string;
+            kind: ("rpc" | "operation" | "event" | "feed");
+            name: string;
+            required: boolean;
+        }>;
+    };
+};
+export type AuthEnvelopesShrinkOutput = {
+    envelope: {
+        boundary: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
+        createdAt: string;
+        deploymentId: string;
+        disabled: boolean;
+        kind: ("service" | "device" | "app" | "cli" | "native" | "device-user");
+        updatedAt: string;
+    };
+    impact: {
+        impactedDeviceSessions: Array<{
+            contractDigest: (string | null);
+            contractId: (string | null);
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
+                }>;
+            };
+            sessionKey: string;
+            type: (("app" | "agent") | "device" | "service");
+        }>;
+        impactedIdentityEnvelopes: Array<{
+            identityAnchor: ({
+                contractId: string;
+                kind: "web";
+                origin: string;
+            } | {
+                contractId: string;
+                kind: "cli";
+                sessionPublicKey: string;
+            } | {
+                contractId: string;
+                kind: "native";
+                sessionPublicKey: string;
+            } | {
+                contractId: string;
+                devicePublicKey: string;
+                kind: "device-user";
+            });
+            identityEnvelopeId: string;
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
+                }>;
+            };
+        }>;
+        impactedPendingRequests: Array<{
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
+                }>;
+            };
+            requestId: string;
+        }>;
+        impactedServiceInstances: Array<{
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
+                }>;
+            };
+        }>;
+        impactedSessions: Array<{
+            contractDigest: (string | null);
+            contractId: (string | null);
+            missing: {
+                capabilities: Array<string>;
+                contracts: Array<{
+                    contractId: string;
+                    required: boolean;
+                }>;
+                resources: Array<{
+                    alias: string;
+                    kind: ("kv" | "store" | "jobs" | "transfer");
+                    required: boolean;
+                }>;
+                surfaces: Array<{
+                    action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                    contractId: string;
+                    kind: ("rpc" | "operation" | "event" | "feed");
+                    name: string;
+                    required: boolean;
+                }>;
+            };
+            sessionKey: string;
+            type: (("app" | "agent") | "device" | "service");
+        }>;
+        orphanedResources: Array<{
+            alias: string;
+            kind: ("kv" | "store" | "jobs" | "transfer");
+        }>;
+        removed: {
+            capabilities: Array<string>;
+            contracts: Array<{
+                contractId: string;
+                required: boolean;
+            }>;
+            resources: Array<{
+                alias: string;
+                kind: ("kv" | "store" | "jobs" | "transfer");
+                required: boolean;
+            }>;
+            surfaces: Array<{
+                action: ("call" | "publish" | "subscribe" | "read" | "cancel");
+                contractId: string;
+                kind: ("rpc" | "operation" | "event" | "feed");
+                name: string;
+                required: boolean;
+            }>;
+        };
     };
+    retainedResources: Array<{
+        alias: string;
+        kind: ("kv" | "store" | "jobs" | "transfer");
+    }>;
 };
 export type AuthHealthInput = {};
 export type AuthHealthOutput = {
@@ -780,328 +1624,382 @@ export type AuthHealthOutput = {
         status: ("ok" | "failed");
         summary?: string;
     }>;
-    service: string;
-    status: ("healthy" | "unhealthy" | "degraded");
-    timestamp: string;
-};
-export type AuthKickConnectionInput = {
-    userNkey: string;
-};
-export type AuthKickConnectionOutput = {
-    success: boolean;
+    service: string;
+    status: ("healthy" | "unhealthy" | "degraded");
+    timestamp: string;
+};
+export type AuthIdentitiesGrantsListInput = {
+    limit: number;
+    offset?: number;
+};
+export type AuthIdentitiesGrantsListOutput = {
+    count: number;
+    entries: Array<{
+        capabilities: Array<string>;
+        contractEvidence: {
+            contractDigest: string;
+            contractId: string;
+        };
+        description: string;
+        displayName: string;
+        grantedAt: string;
+        identityAnchor: ({
+            contractId: string;
+            kind: "web";
+            origin: string;
+        } | {
+            contractId: string;
+            kind: "cli";
+            sessionPublicKey: string;
+        } | {
+            contractId: string;
+            kind: "native";
+            sessionPublicKey: string;
+        } | {
+            contractId: string;
+            devicePublicKey: string;
+            kind: "device-user";
+        });
+        identityEnvelopeId: string;
+        participantKind: ("app" | "agent");
+        updatedAt: string;
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthListApprovalsInput = {
-    digest?: string;
+export type AuthIdentitiesListInput = {
+    limit: number;
+    offset?: number;
     user?: string;
 };
-export type AuthListApprovalsOutput = {
-    approvals: Array<{
+export type AuthIdentitiesListOutput = {
+    count: number;
+    entries: Array<{
         answer: ("approved" | "denied");
         answeredAt: string;
-        approval: {
-            capabilities: Array<string>;
+        capabilities: {
+            [k: string]: {
+                consequence?: string;
+                description: string;
+                displayName: string;
+            };
+        };
+        contractEvidence: {
             contractDigest: string;
             contractId: string;
-            description: string;
-            displayName: string;
         };
+        description: string;
+        displayName: string;
+        identityAnchor: ({
+            contractId: string;
+            kind: "web";
+            origin: string;
+        } | {
+            contractId: string;
+            kind: "cli";
+            sessionPublicKey: string;
+        } | {
+            contractId: string;
+            kind: "native";
+            sessionPublicKey: string;
+        } | {
+            contractId: string;
+            devicePublicKey: string;
+            kind: "device-user";
+        });
+        identityEnvelopeId: string;
         participantKind: ("app" | "agent");
         updatedAt: string;
         user: string;
     }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthListConnectionsInput = {
-    sessionKey?: string;
+export type AuthIdentityEnvelopesRevokeInput = {
+    identityEnvelopeId: string;
     user?: string;
 };
-export type AuthListConnectionsOutput = {
-    connections: Array<({
-        clientId: number;
-        connectedAt: string;
-        contractDisplayName: string;
-        contractId: string;
-        key: string;
-        participantKind: "app";
-        principal: {
-            id: string;
-            name?: string;
-            origin: string;
-            trellisId: string;
-            type: "user";
-        };
-        serverId: string;
-        sessionKey: string;
-        userNkey: string;
-    } | {
-        clientId: number;
-        connectedAt: string;
-        contractDisplayName: string;
-        contractId: string;
-        key: string;
-        participantKind: "agent";
-        principal: {
-            id: string;
-            name?: string;
-            origin: string;
-            trellisId: string;
-            type: "user";
-        };
-        serverId: string;
-        sessionKey: string;
-        userNkey: string;
-    } | {
-        clientId: number;
-        connectedAt: string;
-        contractDisplayName?: string;
-        contractId: string;
-        key: string;
-        participantKind: "device";
-        principal: {
-            deploymentId: string;
-            deviceId: string;
-            deviceType: string;
-            runtimePublicKey: string;
-            type: "device";
-        };
-        serverId: string;
-        sessionKey: string;
-        userNkey: string;
-    } | {
-        clientId: number;
-        connectedAt: string;
-        key: string;
-        participantKind: "service";
-        principal: {
-            deploymentId: string;
-            id: string;
-            instanceId: string;
-            name: string;
-            type: "service";
-        };
-        serverId: string;
-        sessionKey: string;
-        userNkey: string;
-    })>;
+export type AuthIdentityEnvelopesRevokeOutput = {
+    success: boolean;
 };
-export type AuthListDeviceActivationReviewsInput = {
-    deploymentId?: string;
-    instanceId?: string;
-    state?: ("pending" | "approved" | "rejected");
+export type AuthPortalsGetInput = {
+    portalId: string;
 };
-export type AuthListDeviceActivationReviewsOutput = {
-    reviews: Array<{
-        decidedAt: (string | null);
-        deploymentId: string;
-        instanceId: string;
-        publicIdentityKey: string;
-        reason?: string;
-        requestedAt: string;
-        reviewId: string;
-        state: ("pending" | "approved" | "rejected");
+export type AuthPortalsGetOutput = {
+    defaultCapabilities: Array<string>;
+    defaultCapabilityGroups: Array<string>;
+    federatedProviders: Array<{
+        displayName: string;
+        id: string;
+        type: string;
     }>;
-};
-export type AuthListDeviceActivationsInput = {
-    deploymentId?: string;
-    instanceId?: string;
-    state?: ("activated" | "revoked");
-};
-export type AuthListDeviceActivationsOutput = {
-    activations: Array<{
-        activatedAt: string;
-        activatedBy?: {
-            id: string;
-            origin: string;
-        };
-        deploymentId: string;
-        instanceId: string;
-        publicIdentityKey: string;
-        revokedAt: (string | null);
-        state: ("activated" | "revoked");
+    portal: {
+        builtIn: boolean;
+        createdAt: string;
+        disabled: boolean;
+        displayName: string;
+        entryUrl: (string | null);
+        portalId: string;
+        updatedAt: string;
+    };
+    routes: Array<{
+        contractId: (string | null);
+        disabled: boolean;
+        origin: (string | null);
+        portalId: string;
+        routeKey: string;
+        updatedAt: string;
     }>;
+    settings: {
+        allowedFederatedProviders: (Array<string> | null);
+        federatedRegistrationEnabled: boolean;
+        localRegistrationEnabled: boolean;
+        portalId: string;
+        selfRegisteredAccountActive: boolean;
+        updatedAt: string;
+    };
 };
-export type AuthListDeviceDeploymentsInput = {
-    disabled?: boolean;
+export type AuthPortalsListInput = {
+    limit: number;
+    offset?: number;
 };
-export type AuthListDeviceDeploymentsOutput = {
-    deployments: Array<{
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
-        deploymentId: string;
+export type AuthPortalsListOutput = {
+    count: number;
+    entries: Array<{
+        activeRouteCount: number;
+        builtIn: boolean;
+        createdAt: string;
         disabled: boolean;
-        reviewMode?: ("none" | "required");
+        displayName: string;
+        entryUrl: (string | null);
+        portalId: string;
+        routeCount: number;
+        updatedAt: string;
     }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthListDeviceInstancesInput = {
-    deploymentId?: string;
-    state?: ("registered" | "activated" | "revoked" | "disabled");
+export type AuthPortalsLoginSettingsGetInput = {
+    portalId: string;
 };
-export type AuthListDeviceInstancesOutput = {
-    instances: Array<{
-        activatedAt: (string | null);
-        createdAt: string;
-        currentContractDigest?: string;
-        currentContractId?: string;
-        deploymentId: string;
-        instanceId: string;
-        metadata?: {
-            [k: string]: string;
-        };
-        publicIdentityKey: string;
-        revokedAt: (string | null);
-        state: ("registered" | "activated" | "revoked" | "disabled");
+export type AuthPortalsLoginSettingsGetOutput = {
+    defaultCapabilities: Array<string>;
+    defaultCapabilityGroups: Array<string>;
+    federatedProviders: Array<{
+        displayName: string;
+        id: string;
+        type: string;
     }>;
+    portal: {
+        builtIn: boolean;
+        createdAt: string;
+        disabled: boolean;
+        displayName: string;
+        entryUrl: (string | null);
+        portalId: string;
+        updatedAt: string;
+    };
+    settings: {
+        allowedFederatedProviders: (Array<string> | null);
+        federatedRegistrationEnabled: boolean;
+        localRegistrationEnabled: boolean;
+        portalId: string;
+        selfRegisteredAccountActive: boolean;
+        updatedAt: string;
+    };
 };
-export type AuthListDevicePortalSelectionsInput = {};
-export type AuthListDevicePortalSelectionsOutput = {
-    selections: Array<{
-        deploymentId: string;
-        portalId: (string | null);
-    }>;
+export type AuthPortalsLoginSettingsUpdateInput = {
+    allowedFederatedProviders: (Array<string> | null);
+    defaultCapabilities: Array<string>;
+    defaultCapabilityGroups: Array<string>;
+    federatedRegistrationEnabled: boolean;
+    localRegistrationEnabled: boolean;
+    portalId: string;
+    selfRegisteredAccountActive: boolean;
 };
-export type AuthListInstalledContractsInput = {};
-export type AuthListInstalledContractsOutput = {
-    contracts: Array<{
-        analysisSummary?: {
-            events: number;
-            jobsQueues: number;
-            kvResources: number;
-            namespaces: Array<string>;
-            natsPublish: number;
-            natsSubscribe: number;
-            operationControls: number;
-            operations: number;
-            rpcMethods: number;
-            storeResources: number;
-        };
-        description: string;
-        digest: string;
+export type AuthPortalsLoginSettingsUpdateOutput = {
+    defaultCapabilities: Array<string>;
+    defaultCapabilityGroups: Array<string>;
+    federatedProviders: Array<{
         displayName: string;
         id: string;
-        installedAt: string;
+        type: string;
     }>;
-};
-export type AuthListInstanceGrantPoliciesInput = {};
-export type AuthListInstanceGrantPoliciesOutput = {
-    policies: Array<{
-        allowedOrigins?: Array<string>;
-        contractId: string;
+    portal: {
+        builtIn: boolean;
         createdAt: string;
         disabled: boolean;
-        impliedCapabilities: Array<string>;
-        source: ({
-            createdBy?: {
-                id: string;
-                origin: string;
-            };
-            kind: "admin_policy";
-            updatedBy?: {
-                id: string;
-                origin: string;
-            };
-        } | {
-            entryUrl: string;
-            kind: "portal_profile";
-            portalId: string;
-        });
+        displayName: string;
+        entryUrl: (string | null);
+        portalId: string;
         updatedAt: string;
-    }>;
+    };
+    settings: {
+        allowedFederatedProviders: (Array<string> | null);
+        federatedRegistrationEnabled: boolean;
+        localRegistrationEnabled: boolean;
+        portalId: string;
+        selfRegisteredAccountActive: boolean;
+        updatedAt: string;
+    };
 };
-export type AuthListLoginPortalSelectionsInput = {};
-export type AuthListLoginPortalSelectionsOutput = {
-    selections: Array<{
-        contractId: string;
-        portalId: (string | null);
-    }>;
+export type AuthPortalsPutInput = {
+    disabled?: boolean;
+    displayName: string;
+    entryUrl: string;
+    portalId: string;
 };
-export type AuthListPortalProfilesInput = {};
-export type AuthListPortalProfilesOutput = {
-    profiles: Array<{
-        allowedOrigins?: Array<string>;
-        contractId: string;
+export type AuthPortalsPutOutput = {
+    portal: {
+        builtIn: boolean;
         createdAt: string;
         disabled: boolean;
-        entryUrl: string;
-        impliedCapabilities: Array<string>;
+        displayName: string;
+        entryUrl: (string | null);
         portalId: string;
         updatedAt: string;
-    }>;
+    };
+};
+export type AuthPortalsRemoveInput = {
+    portalId: string;
 };
-export type AuthListPortalsInput = {};
-export type AuthListPortalsOutput = {
-    portals: Array<{
+export type AuthPortalsRemoveOutput = {
+    success: boolean;
+};
+export type AuthPortalsRoutesPutInput = {
+    contractId?: (string | null);
+    disabled?: boolean;
+    origin?: (string | null);
+    portalId: string;
+};
+export type AuthPortalsRoutesPutOutput = {
+    route: {
+        contractId: (string | null);
         disabled: boolean;
-        entryUrl: string;
+        origin: (string | null);
         portalId: string;
-    }>;
+        routeKey: string;
+        updatedAt: string;
+    };
 };
-export type AuthListServiceDeploymentsInput = {
-    disabled?: boolean;
+export type AuthPortalsRoutesRemoveInput = {
+    contractId?: (string | null);
+    origin?: (string | null);
+    portalId: string;
+};
+export type AuthPortalsRoutesRemoveOutput = {
+    success: boolean;
+};
+export type AuthRequestsValidateInput = {
+    capabilities?: Array<string>;
+    iat: number;
+    payloadHash: string;
+    proof: string;
+    requestId: string;
+    sessionKey: string;
+    subject: string;
+};
+export type AuthRequestsValidateOutput = {
+    allowed: boolean;
+    caller: ({
+        active: boolean;
+        capabilities: Array<string>;
+        email: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        image?: string;
+        lastAuth: string;
+        name: string;
+        participantKind: ("app" | "agent");
+        type: "user";
+        userId: string;
+    } | {
+        active: boolean;
+        capabilities: Array<string>;
+        id: string;
+        name: string;
+        type: "service";
+    } | {
+        active: boolean;
+        capabilities: Array<string>;
+        deploymentId: string;
+        deviceId: string;
+        deviceType: string;
+        runtimePublicKey: string;
+        type: "device";
+    });
+    inboxPrefix: string;
+};
+export type AuthServiceInstancesDisableInput = {
+    instanceId: string;
 };
-export type AuthListServiceDeploymentsOutput = {
-    deployments: Array<{
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
+export type AuthServiceInstancesDisableOutput = {
+    instance: {
+        capabilities: Array<string>;
+        createdAt: string;
+        currentContractDigest?: string;
+        currentContractId?: string;
+        deploymentId: string;
+        disabled: boolean;
+        instanceId: string;
+        instanceKey: string;
+        resourceBindings?: {
+            jobs?: {
+                namespace: string;
+                queues: {
+                    [k: string]: {
+                        ackWaitMs: number;
+                        backoffMs: Array<number>;
+                        concurrency: number;
+                        consumerName: string;
+                        defaultDeadlineMs?: number;
+                        dlq: boolean;
+                        logs: boolean;
+                        maxDeliver: number;
+                        payload: {
+                            schema: string;
                         };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
+                        progress: boolean;
+                        publishPrefix: string;
+                        queueType: string;
+                        result?: {
+                            schema: string;
                         };
+                        workSubject: string;
                     };
                 };
+                workStream?: string;
             };
-        }>;
-        deploymentId: string;
-        disabled: boolean;
-        namespaces: Array<string>;
-    }>;
+            kv?: {
+                [k: string]: {
+                    bucket: string;
+                    history: number;
+                    maxValueBytes?: number;
+                    ttlMs: number;
+                };
+            };
+            store?: {
+                [k: string]: {
+                    maxObjectBytes?: number;
+                    maxTotalBytes?: number;
+                    name: string;
+                    ttlMs: number;
+                };
+            };
+        };
+    };
 };
-export type AuthListServiceInstancesInput = {
-    deploymentId?: string;
-    disabled?: boolean;
+export type AuthServiceInstancesEnableInput = {
+    instanceId: string;
 };
-export type AuthListServiceInstancesOutput = {
-    instances: Array<{
+export type AuthServiceInstancesEnableOutput = {
+    instance: {
         capabilities: Array<string>;
         createdAt: string;
         currentContractDigest?: string;
@@ -1154,159 +2052,79 @@ export type AuthListServiceInstancesOutput = {
                 };
             };
         };
-    }>;
-};
-export type AuthListSessionsInput = {
-    user?: string;
-};
-export type AuthListSessionsOutput = {
-    sessions: Array<({
-        contractDisplayName: string;
-        contractId: string;
-        createdAt: string;
-        key: string;
-        lastAuth: string;
-        participantKind: "app";
-        principal: {
-            id: string;
-            name?: string;
-            origin: string;
-            trellisId: string;
-            type: "user";
-        };
-        sessionKey: string;
-    } | {
-        contractDisplayName: string;
-        contractId: string;
-        createdAt: string;
-        key: string;
-        lastAuth: string;
-        participantKind: "agent";
-        principal: {
-            id: string;
-            name?: string;
-            origin: string;
-            trellisId: string;
-            type: "user";
-        };
-        sessionKey: string;
-    } | {
-        contractDisplayName?: string;
-        contractId: string;
-        createdAt: string;
-        key: string;
-        lastAuth: string;
-        participantKind: "device";
-        principal: {
-            deploymentId: string;
-            deviceId: string;
-            deviceType: string;
-            runtimePublicKey: string;
-            type: "device";
-        };
-        sessionKey: string;
-    } | {
-        createdAt: string;
-        key: string;
-        lastAuth: string;
-        participantKind: "service";
-        principal: {
-            deploymentId: string;
-            id: string;
-            instanceId: string;
-            name: string;
-            type: "service";
-        };
-        sessionKey: string;
-    })>;
-};
-export type AuthListUserGrantsInput = {};
-export type AuthListUserGrantsOutput = {
-    grants: Array<{
-        capabilities: Array<string>;
-        contractDigest: string;
-        contractId: string;
-        description: string;
-        displayName: string;
-        grantedAt: string;
-        participantKind: ("app" | "agent");
-        updatedAt: string;
-    }>;
-};
-export type AuthListUsersInput = {};
-export type AuthListUsersOutput = {
-    users: Array<{
-        active: boolean;
-        capabilities: Array<string>;
-        email?: string;
-        id: string;
-        name?: string;
-        origin: string;
-    }>;
+    };
 };
-export type AuthLogoutInput = {};
-export type AuthLogoutOutput = {
-    success: boolean;
+export type AuthServiceInstancesListInput = {
+    deploymentId?: string;
+    disabled?: boolean;
+    limit: number;
+    offset?: number;
 };
-export type AuthMeInput = {};
-export type AuthMeOutput = {
-    device: ({
-        active: boolean;
-        capabilities: Array<string>;
-        deploymentId: string;
-        deviceId: string;
-        deviceType: string;
-        runtimePublicKey: string;
-        type: "device";
-    } | null);
-    participantKind: (("app" | "agent") | "device" | "service");
-    service: ({
-        active: boolean;
-        capabilities: Array<string>;
-        id: string;
-        name: string;
-        type: "service";
-    } | null);
-    user: ({
-        active: boolean;
+export type AuthServiceInstancesListOutput = {
+    count: number;
+    entries: Array<{
         capabilities: Array<string>;
-        email: string;
-        id: string;
-        image?: string;
-        lastLogin?: string;
-        name: string;
-        origin: string;
-    } | null);
-};
-export type AuthProvisionDeviceInstanceInput = {
-    activationKey: string;
-    deploymentId: string;
-    metadata?: {
-        [k: string]: string;
-    };
-    publicIdentityKey: string;
-};
-export type AuthProvisionDeviceInstanceOutput = {
-    instance: {
-        activatedAt: (string | null);
         createdAt: string;
         currentContractDigest?: string;
         currentContractId?: string;
         deploymentId: string;
+        disabled: boolean;
         instanceId: string;
-        metadata?: {
-            [k: string]: string;
+        instanceKey: string;
+        resourceBindings?: {
+            jobs?: {
+                namespace: string;
+                queues: {
+                    [k: string]: {
+                        ackWaitMs: number;
+                        backoffMs: Array<number>;
+                        concurrency: number;
+                        consumerName: string;
+                        defaultDeadlineMs?: number;
+                        dlq: boolean;
+                        logs: boolean;
+                        maxDeliver: number;
+                        payload: {
+                            schema: string;
+                        };
+                        progress: boolean;
+                        publishPrefix: string;
+                        queueType: string;
+                        result?: {
+                            schema: string;
+                        };
+                        workSubject: string;
+                    };
+                };
+                workStream?: string;
+            };
+            kv?: {
+                [k: string]: {
+                    bucket: string;
+                    history: number;
+                    maxValueBytes?: number;
+                    ttlMs: number;
+                };
+            };
+            store?: {
+                [k: string]: {
+                    maxObjectBytes?: number;
+                    maxTotalBytes?: number;
+                    name: string;
+                    ttlMs: number;
+                };
+            };
         };
-        publicIdentityKey: string;
-        revokedAt: (string | null);
-        state: ("registered" | "activated" | "revoked" | "disabled");
-    };
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthProvisionServiceInstanceInput = {
+export type AuthServiceInstancesProvisionInput = {
     deploymentId: string;
     instanceKey: string;
 };
-export type AuthProvisionServiceInstanceOutput = {
+export type AuthServiceInstancesProvisionOutput = {
     instance: {
         capabilities: Array<string>;
         createdAt: string;
@@ -1358,278 +2176,289 @@ export type AuthProvisionServiceInstanceOutput = {
                     name: string;
                     ttlMs: number;
                 };
-            };
-        };
-    };
-};
-export type AuthRemoveDeviceDeploymentInput = {
-    deploymentId: string;
-};
-export type AuthRemoveDeviceDeploymentOutput = {
-    success: boolean;
-};
-export type AuthRemoveDeviceInstanceInput = {
-    instanceId: string;
-};
-export type AuthRemoveDeviceInstanceOutput = {
-    success: boolean;
-};
-export type AuthRemoveServiceDeploymentInput = {
-    deploymentId: string;
-};
-export type AuthRemoveServiceDeploymentOutput = {
-    success: boolean;
-};
-export type AuthRemoveServiceInstanceInput = {
-    instanceId: string;
-};
-export type AuthRemoveServiceInstanceOutput = {
-    success: boolean;
-};
-export type AuthRevokeApprovalInput = {
-    contractDigest: string;
-    user?: string;
-};
-export type AuthRevokeApprovalOutput = {
-    success: boolean;
+            };
+        };
+    };
 };
-export type AuthRevokeDeviceActivationInput = {
+export type AuthServiceInstancesRemoveInput = {
     instanceId: string;
 };
-export type AuthRevokeDeviceActivationOutput = {
+export type AuthServiceInstancesRemoveOutput = {
     success: boolean;
 };
-export type AuthRevokeSessionInput = {
-    sessionKey: string;
-};
-export type AuthRevokeSessionOutput = {
-    success: boolean;
+export type AuthSessionsListInput = {
+    limit: number;
+    offset?: number;
+    user?: string;
 };
-export type AuthRevokeUserGrantInput = {
-    contractDigest: string;
+export type AuthSessionsListOutput = {
+    count: number;
+    entries: Array<({
+        contractDisplayName: string;
+        contractId: string;
+        createdAt: string;
+        key: string;
+        lastAuth: string;
+        participantKind: "app";
+        principal: {
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            name: string;
+            type: "user";
+            userId: string;
+        };
+        sessionKey: string;
+    } | {
+        contractDisplayName: string;
+        contractId: string;
+        createdAt: string;
+        key: string;
+        lastAuth: string;
+        participantKind: "agent";
+        principal: {
+            identity: {
+                identityId: string;
+                provider: string;
+                subject: string;
+            };
+            name: string;
+            type: "user";
+            userId: string;
+        };
+        sessionKey: string;
+    } | {
+        contractDisplayName?: string;
+        contractId: string;
+        createdAt: string;
+        key: string;
+        lastAuth: string;
+        participantKind: "device";
+        principal: {
+            deploymentId: string;
+            deviceId: string;
+            deviceType: string;
+            runtimePublicKey: string;
+            type: "device";
+        };
+        sessionKey: string;
+    } | {
+        createdAt: string;
+        key: string;
+        lastAuth: string;
+        participantKind: "service";
+        principal: {
+            deploymentId: string;
+            id: string;
+            instanceId: string;
+            name: string;
+            type: "service";
+        };
+        sessionKey: string;
+    })>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthRevokeUserGrantOutput = {
+export type AuthSessionsLogoutInput = {};
+export type AuthSessionsLogoutOutput = {
     success: boolean;
 };
-export type AuthSetDevicePortalDefaultInput = {
-    portalId: (string | null);
+export type AuthSessionsMeInput = {};
+export type AuthSessionsMeOutput = {
+    device: ({
+        active: boolean;
+        capabilities: Array<string>;
+        deploymentId: string;
+        deviceId: string;
+        deviceType: string;
+        runtimePublicKey: string;
+        type: "device";
+    } | null);
+    participantKind: (("app" | "agent") | "device" | "service");
+    service: ({
+        active: boolean;
+        capabilities: Array<string>;
+        id: string;
+        name: string;
+        type: "service";
+    } | null);
+    user: ({
+        active: boolean;
+        capabilities: Array<string>;
+        email: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        image?: string;
+        lastLogin?: string;
+        name: string;
+        userId: string;
+    } | null);
 };
-export type AuthSetDevicePortalDefaultOutput = {
-    defaultPortal: {
-        portalId: (string | null);
-    };
+export type AuthSessionsRevokeInput = {
+    sessionKey: string;
 };
-export type AuthSetDevicePortalSelectionInput = {
-    deploymentId: string;
-    portalId: (string | null);
+export type AuthSessionsRevokeOutput = {
+    success: boolean;
 };
-export type AuthSetDevicePortalSelectionOutput = {
-    selection: {
-        deploymentId: string;
-        portalId: (string | null);
-    };
+export type AuthUserIdentitiesListInput = {
+    limit: number;
+    offset?: number;
+    userId: string;
+};
+export type AuthUserIdentitiesListOutput = {
+    count: number;
+    entries: Array<{
+        displayName: (string | null);
+        email: (string | null);
+        emailVerified: boolean;
+        identityId: string;
+        lastLoginAt: (string | null);
+        linkedAt: string;
+        provider: string;
+        subject: string;
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthSetLoginPortalDefaultInput = {
-    portalId: (string | null);
+export type AuthUserIdentitiesUnlinkInput = {
+    identityId: string;
+    userId: string;
 };
-export type AuthSetLoginPortalDefaultOutput = {
-    defaultPortal: {
-        portalId: (string | null);
-    };
+export type AuthUserIdentitiesUnlinkOutput = {
+    success: boolean;
 };
-export type AuthSetLoginPortalSelectionInput = {
-    contractId: string;
-    portalId: (string | null);
+export type AuthUsersCreateInput = {
+    active?: boolean;
+    capabilities?: Array<string>;
+    capabilityGroups?: Array<string>;
+    email?: string;
+    name?: string;
+    username?: string;
 };
-export type AuthSetLoginPortalSelectionOutput = {
-    selection: {
-        contractId: string;
-        portalId: (string | null);
+export type AuthUsersCreateOutput = {
+    user: {
+        active: boolean;
+        capabilities: Array<string>;
+        capabilityGroups: Array<string>;
+        email?: string;
+        identities: Array<{
+            displayName: (string | null);
+            email: (string | null);
+            emailVerified: boolean;
+            identityId: string;
+            lastLoginAt: (string | null);
+            linkedAt: string;
+            provider: string;
+            subject: string;
+        }>;
+        name?: string;
+        userId: string;
     };
 };
-export type AuthSetPortalProfileInput = {
-    allowedOrigins?: Array<string>;
-    contractId: string;
-    entryUrl: string;
-    portalId: string;
+export type AuthUsersGetInput = {
+    userId: string;
 };
-export type AuthSetPortalProfileOutput = {
-    profile: {
-        allowedOrigins?: Array<string>;
-        contractId: string;
-        createdAt: string;
-        disabled: boolean;
-        entryUrl: string;
-        impliedCapabilities: Array<string>;
-        portalId: string;
-        updatedAt: string;
+export type AuthUsersGetOutput = {
+    user: {
+        active: boolean;
+        capabilities: Array<string>;
+        capabilityGroups: Array<string>;
+        email?: string;
+        identities: Array<{
+            displayName: (string | null);
+            email: (string | null);
+            emailVerified: boolean;
+            identityId: string;
+            lastLoginAt: (string | null);
+            linkedAt: string;
+            provider: string;
+            subject: string;
+        }>;
+        name?: string;
+        userId: string;
     };
 };
-export type AuthUnapplyDeviceDeploymentContractInput = {
-    contractId: string;
-    deploymentId: string;
-    digests?: Array<string>;
+export type AuthUsersIdentityLinkCreateInput = {
+    returnTo?: string;
 };
-export type AuthUnapplyDeviceDeploymentContractOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-        }>;
-        deploymentId: string;
-        disabled: boolean;
-        reviewMode?: ("none" | "required");
-    };
+export type AuthUsersIdentityLinkCreateOutput = {
+    expiresAt: string;
+    flowId: string;
+    url: string;
 };
-export type AuthUnapplyServiceDeploymentContractInput = {
-    contractId: string;
-    deploymentId: string;
-    digests?: Array<string>;
+export type AuthUsersListInput = {
+    limit: number;
+    offset?: number;
 };
-export type AuthUnapplyServiceDeploymentContractOutput = {
-    deployment: {
-        appliedContracts: Array<{
-            allowedDigests: Array<string>;
-            contractId: string;
-            resourceBindingsByDigest?: {
-                [k: string]: {
-                    jobs?: {
-                        namespace: string;
-                        queues: {
-                            [k: string]: {
-                                ackWaitMs: number;
-                                backoffMs: Array<number>;
-                                concurrency: number;
-                                consumerName: string;
-                                defaultDeadlineMs?: number;
-                                dlq: boolean;
-                                logs: boolean;
-                                maxDeliver: number;
-                                payload: {
-                                    schema: string;
-                                };
-                                progress: boolean;
-                                publishPrefix: string;
-                                queueType: string;
-                                result?: {
-                                    schema: string;
-                                };
-                                workSubject: string;
-                            };
-                        };
-                        workStream?: string;
-                    };
-                    kv?: {
-                        [k: string]: {
-                            bucket: string;
-                            history: number;
-                            maxValueBytes?: number;
-                            ttlMs: number;
-                        };
-                    };
-                    store?: {
-                        [k: string]: {
-                            maxObjectBytes?: number;
-                            maxTotalBytes?: number;
-                            name: string;
-                            ttlMs: number;
-                        };
-                    };
-                };
-            };
+export type AuthUsersListOutput = {
+    count: number;
+    entries: Array<{
+        active: boolean;
+        capabilities: Array<string>;
+        capabilityGroups: Array<string>;
+        email?: string;
+        identities: Array<{
+            displayName: (string | null);
+            email: (string | null);
+            emailVerified: boolean;
+            identityId: string;
+            lastLoginAt: (string | null);
+            linkedAt: string;
+            provider: string;
+            subject: string;
         }>;
-        deploymentId: string;
-        disabled: boolean;
-        namespaces: Array<string>;
-    };
+        name?: string;
+        userId: string;
+    }>;
+    limit: number;
+    nextOffset?: number;
+    offset: number;
 };
-export type AuthUpdateUserInput = {
-    active?: boolean;
-    capabilities?: Array<string>;
-    id: string;
-    origin: string;
+export type AuthUsersPasswordChangeInput = {
+    currentPassword: string;
+    newPassword: string;
 };
-export type AuthUpdateUserOutput = {
+export type AuthUsersPasswordChangeOutput = {
     success: boolean;
 };
-export type AuthUpsertInstanceGrantPolicyInput = {
-    allowedOrigins?: Array<string>;
-    contractId: string;
-    impliedCapabilities: Array<string>;
+export type AuthUsersPasswordResetCreateInput = {
+    expiresInSeconds?: number;
+    userId: string;
 };
-export type AuthUpsertInstanceGrantPolicyOutput = {
-    policy: {
-        allowedOrigins?: Array<string>;
-        contractId: string;
-        createdAt: string;
-        disabled: boolean;
-        impliedCapabilities: Array<string>;
-        source: ({
-            createdBy?: {
-                id: string;
-                origin: string;
-            };
-            kind: "admin_policy";
-            updatedBy?: {
-                id: string;
-                origin: string;
-            };
-        } | {
-            entryUrl: string;
-            kind: "portal_profile";
-            portalId: string;
-        });
-        updatedAt: string;
-    };
+export type AuthUsersPasswordResetCreateOutput = {
+    expiresAt: string;
+    flowId: string;
+    url: string;
 };
-export type AuthValidateRequestInput = {
+export type AuthUsersUpdateInput = {
+    active?: boolean;
     capabilities?: Array<string>;
-    payloadHash: string;
-    proof: string;
-    sessionKey: string;
-    subject: string;
+    capabilityGroups?: Array<string>;
+    email?: string;
+    name?: string;
+    userId: string;
 };
-export type AuthValidateRequestOutput = {
-    allowed: boolean;
-    caller: ({
-        active: boolean;
-        capabilities: Array<string>;
-        email: string;
-        id: string;
-        image?: string;
-        name: string;
-        origin: string;
-        participantKind: ("app" | "agent");
-        trellisId: string;
-        type: "user";
-    } | {
-        active: boolean;
-        capabilities: Array<string>;
-        id: string;
-        name: string;
-        type: "service";
-    } | {
-        active: boolean;
-        capabilities: Array<string>;
-        deploymentId: string;
-        deviceId: string;
-        deviceType: string;
-        runtimePublicKey: string;
-        type: "device";
-    });
-    inboxPrefix: string;
+export type AuthUsersUpdateOutput = {
+    success: boolean;
 };
-export type AuthActivateDeviceInput = {
+export type AuthDeviceUserAuthoritiesResolveInput = {
     flowId: string;
 };
-export type AuthActivateDeviceProgress = {
+export type AuthDeviceUserAuthoritiesResolveProgress = {
     deploymentId: string;
     instanceId: string;
     requestedAt: string;
     reviewId: string;
     status: "pending_review";
 };
-export type AuthActivateDeviceOutput = ({
+export type AuthDeviceUserAuthoritiesResolveOutput = ({
     activatedAt: string;
     confirmationCode?: string;
     deploymentId: string;
@@ -1639,7 +2468,7 @@ export type AuthActivateDeviceOutput = ({
     reason?: string;
     status: "rejected";
 });
-export type AuthConnectEvent = ({
+export type AuthConnectionsClosedEvent = ({
     header: {
         id: string;
         time: string;
@@ -1650,7 +2479,7 @@ export type AuthConnectEvent = ({
     sessionKey: string;
     userNkey: string;
 });
-export type AuthConnectionKickedEvent = ({
+export type AuthConnectionsKickedEvent = ({
     header: {
         id: string;
         time: string;
@@ -1661,23 +2490,27 @@ export type AuthConnectionKickedEvent = ({
     origin: string;
     userNkey: string;
 });
-export type AuthDeviceActivatedEvent = {
-    activatedAt: string;
-    activatedBy: {
+export type AuthConnectionsOpenedEvent = ({
+    header: {
         id: string;
-        origin: string;
+        time: string;
     };
-    deploymentId: string;
-    flowId?: string;
-    instanceId: string;
-    publicIdentityKey: string;
-    reviewId?: string;
-};
-export type AuthDeviceActivationApprovedEvent = {
+} & {
+    id: string;
+    origin: string;
+    sessionKey: string;
+    userNkey: string;
+});
+export type AuthDeviceUserAuthoritiesApprovedEvent = {
     approvedAt: string;
     approvedBy: {
-        id: string;
-        origin?: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        participantKind: ("app" | "agent");
+        userId: string;
     };
     deploymentId: string;
     flowId: string;
@@ -1685,46 +2518,67 @@ export type AuthDeviceActivationApprovedEvent = {
     publicIdentityKey: string;
     requestedAt: string;
     requestedBy: {
-        id: string;
-        origin: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        participantKind: ("app" | "agent");
+        userId: string;
     };
     reviewId: string;
 };
-export type AuthDeviceActivationRequestedEvent = {
+export type AuthDeviceUserAuthoritiesRequestedEvent = {
     deploymentId: string;
     flowId: string;
     instanceId: string;
     publicIdentityKey: string;
     requestedAt: string;
     requestedBy: {
-        id: string;
-        origin: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        participantKind: ("app" | "agent");
+        userId: string;
+    };
+};
+export type AuthDeviceUserAuthoritiesResolvedEvent = {
+    deploymentId: string;
+    flowId?: string;
+    instanceId: string;
+    publicIdentityKey: string;
+    resolvedAt: string;
+    resolvedBy: {
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        participantKind: ("app" | "agent");
+        userId: string;
     };
+    reviewId?: string;
 };
-export type AuthDeviceActivationReviewRequestedEvent = {
+export type AuthDeviceUserAuthoritiesReviewRequestedEvent = {
     deploymentId: string;
     flowId: string;
     instanceId: string;
     publicIdentityKey: string;
     requestedAt: string;
     requestedBy: {
-        id: string;
-        origin: string;
+        identity: {
+            identityId: string;
+            provider: string;
+            subject: string;
+        };
+        participantKind: ("app" | "agent");
+        userId: string;
     };
     reviewId: string;
 };
-export type AuthDisconnectEvent = ({
-    header: {
-        id: string;
-        time: string;
-    };
-} & {
-    id: string;
-    origin: string;
-    sessionKey: string;
-    userNkey: string;
-});
-export type AuthSessionRevokedEvent = ({
+export type AuthSessionsRevokedEvent = ({
     header: {
         id: string;
         time: string;
@@ -1736,353 +2590,360 @@ export type AuthSessionRevokedEvent = ({
     sessionKey: string;
 });
 export interface RpcMap {
-    "Auth.ApplyDeviceDeploymentContract": {
-        input: AuthApplyDeviceDeploymentContractInput;
-        output: AuthApplyDeviceDeploymentContractOutput;
+    "Auth.Capabilities.List": {
+        input: AuthCapabilitiesListInput;
+        output: AuthCapabilitiesListOutput;
     };
-    "Auth.ApplyServiceDeploymentContract": {
-        input: AuthApplyServiceDeploymentContractInput;
-        output: AuthApplyServiceDeploymentContractOutput;
+    "Auth.CapabilityGroups.Delete": {
+        input: AuthCapabilityGroupsDeleteInput;
+        output: AuthCapabilityGroupsDeleteOutput;
     };
-    "Auth.ClearDevicePortalSelection": {
-        input: AuthClearDevicePortalSelectionInput;
-        output: AuthClearDevicePortalSelectionOutput;
+    "Auth.CapabilityGroups.Get": {
+        input: AuthCapabilityGroupsGetInput;
+        output: AuthCapabilityGroupsGetOutput;
     };
-    "Auth.ClearLoginPortalSelection": {
-        input: AuthClearLoginPortalSelectionInput;
-        output: AuthClearLoginPortalSelectionOutput;
+    "Auth.CapabilityGroups.List": {
+        input: AuthCapabilityGroupsListInput;
+        output: AuthCapabilityGroupsListOutput;
     };
-    "Auth.CreateDeviceDeployment": {
-        input: AuthCreateDeviceDeploymentInput;
-        output: AuthCreateDeviceDeploymentOutput;
+    "Auth.CapabilityGroups.Put": {
+        input: AuthCapabilityGroupsPutInput;
+        output: AuthCapabilityGroupsPutOutput;
     };
-    "Auth.CreatePortal": {
-        input: AuthCreatePortalInput;
-        output: AuthCreatePortalOutput;
+    "Auth.CatalogIssues.Resolve": {
+        input: AuthCatalogIssuesResolveInput;
+        output: AuthCatalogIssuesResolveOutput;
     };
-    "Auth.CreateServiceDeployment": {
-        input: AuthCreateServiceDeploymentInput;
-        output: AuthCreateServiceDeploymentOutput;
+    "Auth.Connections.Kick": {
+        input: AuthConnectionsKickInput;
+        output: AuthConnectionsKickOutput;
     };
-    "Auth.DecideDeviceActivationReview": {
-        input: AuthDecideDeviceActivationReviewInput;
-        output: AuthDecideDeviceActivationReviewOutput;
+    "Auth.Connections.List": {
+        input: AuthConnectionsListInput;
+        output: AuthConnectionsListOutput;
     };
-    "Auth.DisableDeviceDeployment": {
-        input: AuthDisableDeviceDeploymentInput;
-        output: AuthDisableDeviceDeploymentOutput;
+    "Auth.Deployments.Create": {
+        input: AuthDeploymentsCreateInput;
+        output: AuthDeploymentsCreateOutput;
     };
-    "Auth.DisableDeviceInstance": {
-        input: AuthDisableDeviceInstanceInput;
-        output: AuthDisableDeviceInstanceOutput;
+    "Auth.Deployments.Disable": {
+        input: AuthDeploymentsDisableInput;
+        output: AuthDeploymentsDisableOutput;
     };
-    "Auth.DisableInstanceGrantPolicy": {
-        input: AuthDisableInstanceGrantPolicyInput;
-        output: AuthDisableInstanceGrantPolicyOutput;
+    "Auth.Deployments.Enable": {
+        input: AuthDeploymentsEnableInput;
+        output: AuthDeploymentsEnableOutput;
     };
-    "Auth.DisablePortal": {
-        input: AuthDisablePortalInput;
-        output: AuthDisablePortalOutput;
+    "Auth.Deployments.List": {
+        input: AuthDeploymentsListInput;
+        output: AuthDeploymentsListOutput;
     };
-    "Auth.DisablePortalProfile": {
-        input: AuthDisablePortalProfileInput;
-        output: AuthDisablePortalProfileOutput;
+    "Auth.Deployments.Remove": {
+        input: AuthDeploymentsRemoveInput;
+        output: AuthDeploymentsRemoveOutput;
     };
-    "Auth.DisableServiceDeployment": {
-        input: AuthDisableServiceDeploymentInput;
-        output: AuthDisableServiceDeploymentOutput;
+    "Auth.DeviceUserAuthorities.List": {
+        input: AuthDeviceUserAuthoritiesListInput;
+        output: AuthDeviceUserAuthoritiesListOutput;
     };
-    "Auth.DisableServiceInstance": {
-        input: AuthDisableServiceInstanceInput;
-        output: AuthDisableServiceInstanceOutput;
+    "Auth.DeviceUserAuthorities.Reviews.Decide": {
+        input: AuthDeviceUserAuthoritiesReviewsDecideInput;
+        output: AuthDeviceUserAuthoritiesReviewsDecideOutput;
     };
-    "Auth.EnableDeviceDeployment": {
-        input: AuthEnableDeviceDeploymentInput;
-        output: AuthEnableDeviceDeploymentOutput;
+    "Auth.DeviceUserAuthorities.Reviews.List": {
+        input: AuthDeviceUserAuthoritiesReviewsListInput;
+        output: AuthDeviceUserAuthoritiesReviewsListOutput;
     };
-    "Auth.EnableDeviceInstance": {
-        input: AuthEnableDeviceInstanceInput;
-        output: AuthEnableDeviceInstanceOutput;
+    "Auth.DeviceUserAuthorities.Revoke": {
+        input: AuthDeviceUserAuthoritiesRevokeInput;
+        output: AuthDeviceUserAuthoritiesRevokeOutput;
     };
-    "Auth.EnableServiceDeployment": {
-        input: AuthEnableServiceDeploymentInput;
-        output: AuthEnableServiceDeploymentOutput;
+    "Auth.Devices.ConnectInfo.Get": {
+        input: AuthDevicesConnectInfoGetInput;
+        output: AuthDevicesConnectInfoGetOutput;
     };
-    "Auth.EnableServiceInstance": {
-        input: AuthEnableServiceInstanceInput;
-        output: AuthEnableServiceInstanceOutput;
+    "Auth.Devices.Disable": {
+        input: AuthDevicesDisableInput;
+        output: AuthDevicesDisableOutput;
     };
-    "Auth.GetDeviceConnectInfo": {
-        input: AuthGetDeviceConnectInfoInput;
-        output: AuthGetDeviceConnectInfoOutput;
+    "Auth.Devices.Enable": {
+        input: AuthDevicesEnableInput;
+        output: AuthDevicesEnableOutput;
     };
-    "Auth.GetDevicePortalDefault": {
-        input: AuthGetDevicePortalDefaultInput;
-        output: AuthGetDevicePortalDefaultOutput;
+    "Auth.Devices.List": {
+        input: AuthDevicesListInput;
+        output: AuthDevicesListOutput;
     };
-    "Auth.GetInstalledContract": {
-        input: AuthGetInstalledContractInput;
-        output: AuthGetInstalledContractOutput;
+    "Auth.Devices.Provision": {
+        input: AuthDevicesProvisionInput;
+        output: AuthDevicesProvisionOutput;
     };
-    "Auth.GetLoginPortalDefault": {
-        input: AuthGetLoginPortalDefaultInput;
-        output: AuthGetLoginPortalDefaultOutput;
+    "Auth.Devices.Remove": {
+        input: AuthDevicesRemoveInput;
+        output: AuthDevicesRemoveOutput;
     };
-    "Auth.Health": {
-        input: AuthHealthInput;
-        output: AuthHealthOutput;
+    "Auth.EnvelopeExpansions.Approve": {
+        input: AuthEnvelopeExpansionsApproveInput;
+        output: AuthEnvelopeExpansionsApproveOutput;
+    };
+    "Auth.EnvelopeExpansions.List": {
+        input: AuthEnvelopeExpansionsListInput;
+        output: AuthEnvelopeExpansionsListOutput;
     };
-    "Auth.KickConnection": {
-        input: AuthKickConnectionInput;
-        output: AuthKickConnectionOutput;
+    "Auth.EnvelopeExpansions.Reject": {
+        input: AuthEnvelopeExpansionsRejectInput;
+        output: AuthEnvelopeExpansionsRejectOutput;
     };
-    "Auth.ListApprovals": {
-        input: AuthListApprovalsInput;
-        output: AuthListApprovalsOutput;
+    "Auth.Envelopes.Changes.Preview": {
+        input: AuthEnvelopesChangesPreviewInput;
+        output: AuthEnvelopesChangesPreviewOutput;
     };
-    "Auth.ListConnections": {
-        input: AuthListConnectionsInput;
-        output: AuthListConnectionsOutput;
+    "Auth.Envelopes.Expand": {
+        input: AuthEnvelopesExpandInput;
+        output: AuthEnvelopesExpandOutput;
     };
-    "Auth.ListDeviceActivationReviews": {
-        input: AuthListDeviceActivationReviewsInput;
-        output: AuthListDeviceActivationReviewsOutput;
+    "Auth.Envelopes.Get": {
+        input: AuthEnvelopesGetInput;
+        output: AuthEnvelopesGetOutput;
     };
-    "Auth.ListDeviceActivations": {
-        input: AuthListDeviceActivationsInput;
-        output: AuthListDeviceActivationsOutput;
+    "Auth.Envelopes.GrantOverrides.List": {
+        input: AuthEnvelopesGrantOverridesListInput;
+        output: AuthEnvelopesGrantOverridesListOutput;
     };
-    "Auth.ListDeviceDeployments": {
-        input: AuthListDeviceDeploymentsInput;
-        output: AuthListDeviceDeploymentsOutput;
+    "Auth.Envelopes.GrantOverrides.Put": {
+        input: AuthEnvelopesGrantOverridesPutInput;
+        output: AuthEnvelopesGrantOverridesPutOutput;
     };
-    "Auth.ListDeviceInstances": {
-        input: AuthListDeviceInstancesInput;
-        output: AuthListDeviceInstancesOutput;
+    "Auth.Envelopes.GrantOverrides.Remove": {
+        input: AuthEnvelopesGrantOverridesRemoveInput;
+        output: AuthEnvelopesGrantOverridesRemoveOutput;
     };
-    "Auth.ListDevicePortalSelections": {
-        input: AuthListDevicePortalSelectionsInput;
-        output: AuthListDevicePortalSelectionsOutput;
+    "Auth.Envelopes.List": {
+        input: AuthEnvelopesListInput;
+        output: AuthEnvelopesListOutput;
     };
-    "Auth.ListInstalledContracts": {
-        input: AuthListInstalledContractsInput;
-        output: AuthListInstalledContractsOutput;
+    "Auth.Envelopes.Shrink": {
+        input: AuthEnvelopesShrinkInput;
+        output: AuthEnvelopesShrinkOutput;
     };
-    "Auth.ListInstanceGrantPolicies": {
-        input: AuthListInstanceGrantPoliciesInput;
-        output: AuthListInstanceGrantPoliciesOutput;
+    "Auth.Health": {
+        input: AuthHealthInput;
+        output: AuthHealthOutput;
     };
-    "Auth.ListLoginPortalSelections": {
-        input: AuthListLoginPortalSelectionsInput;
-        output: AuthListLoginPortalSelectionsOutput;
+    "Auth.Identities.Grants.List": {
+        input: AuthIdentitiesGrantsListInput;
+        output: AuthIdentitiesGrantsListOutput;
     };
-    "Auth.ListPortalProfiles": {
-        input: AuthListPortalProfilesInput;
-        output: AuthListPortalProfilesOutput;
+    "Auth.Identities.List": {
+        input: AuthIdentitiesListInput;
+        output: AuthIdentitiesListOutput;
     };
-    "Auth.ListPortals": {
-        input: AuthListPortalsInput;
-        output: AuthListPortalsOutput;
+    "Auth.IdentityEnvelopes.Revoke": {
+        input: AuthIdentityEnvelopesRevokeInput;
+        output: AuthIdentityEnvelopesRevokeOutput;
     };
-    "Auth.ListServiceDeployments": {
-        input: AuthListServiceDeploymentsInput;
-        output: AuthListServiceDeploymentsOutput;
+    "Auth.Portals.Get": {
+        input: AuthPortalsGetInput;
+        output: AuthPortalsGetOutput;
     };
-    "Auth.ListServiceInstances": {
-        input: AuthListServiceInstancesInput;
-        output: AuthListServiceInstancesOutput;
+    "Auth.Portals.List": {
+        input: AuthPortalsListInput;
+        output: AuthPortalsListOutput;
     };
-    "Auth.ListSessions": {
-        input: AuthListSessionsInput;
-        output: AuthListSessionsOutput;
+    "Auth.Portals.LoginSettings.Get": {
+        input: AuthPortalsLoginSettingsGetInput;
+        output: AuthPortalsLoginSettingsGetOutput;
     };
-    "Auth.ListUserGrants": {
-        input: AuthListUserGrantsInput;
-        output: AuthListUserGrantsOutput;
+    "Auth.Portals.LoginSettings.Update": {
+        input: AuthPortalsLoginSettingsUpdateInput;
+        output: AuthPortalsLoginSettingsUpdateOutput;
     };
-    "Auth.ListUsers": {
-        input: AuthListUsersInput;
-        output: AuthListUsersOutput;
+    "Auth.Portals.Put": {
+        input: AuthPortalsPutInput;
+        output: AuthPortalsPutOutput;
     };
-    "Auth.Logout": {
-        input: AuthLogoutInput;
-        output: AuthLogoutOutput;
+    "Auth.Portals.Remove": {
+        input: AuthPortalsRemoveInput;
+        output: AuthPortalsRemoveOutput;
     };
-    "Auth.Me": {
-        input: AuthMeInput;
-        output: AuthMeOutput;
+    "Auth.Portals.Routes.Put": {
+        input: AuthPortalsRoutesPutInput;
+        output: AuthPortalsRoutesPutOutput;
     };
-    "Auth.ProvisionDeviceInstance": {
-        input: AuthProvisionDeviceInstanceInput;
-        output: AuthProvisionDeviceInstanceOutput;
+    "Auth.Portals.Routes.Remove": {
+        input: AuthPortalsRoutesRemoveInput;
+        output: AuthPortalsRoutesRemoveOutput;
     };
-    "Auth.ProvisionServiceInstance": {
-        input: AuthProvisionServiceInstanceInput;
-        output: AuthProvisionServiceInstanceOutput;
+    "Auth.Requests.Validate": {
+        input: AuthRequestsValidateInput;
+        output: AuthRequestsValidateOutput;
     };
-    "Auth.RemoveDeviceDeployment": {
-        input: AuthRemoveDeviceDeploymentInput;
-        output: AuthRemoveDeviceDeploymentOutput;
+    "Auth.ServiceInstances.Disable": {
+        input: AuthServiceInstancesDisableInput;
+        output: AuthServiceInstancesDisableOutput;
     };
-    "Auth.RemoveDeviceInstance": {
-        input: AuthRemoveDeviceInstanceInput;
-        output: AuthRemoveDeviceInstanceOutput;
+    "Auth.ServiceInstances.Enable": {
+        input: AuthServiceInstancesEnableInput;
+        output: AuthServiceInstancesEnableOutput;
     };
-    "Auth.RemoveServiceDeployment": {
-        input: AuthRemoveServiceDeploymentInput;
-        output: AuthRemoveServiceDeploymentOutput;
+    "Auth.ServiceInstances.List": {
+        input: AuthServiceInstancesListInput;
+        output: AuthServiceInstancesListOutput;
     };
-    "Auth.RemoveServiceInstance": {
-        input: AuthRemoveServiceInstanceInput;
-        output: AuthRemoveServiceInstanceOutput;
+    "Auth.ServiceInstances.Provision": {
+        input: AuthServiceInstancesProvisionInput;
+        output: AuthServiceInstancesProvisionOutput;
     };
-    "Auth.RevokeApproval": {
-        input: AuthRevokeApprovalInput;
-        output: AuthRevokeApprovalOutput;
+    "Auth.ServiceInstances.Remove": {
+        input: AuthServiceInstancesRemoveInput;
+        output: AuthServiceInstancesRemoveOutput;
     };
-    "Auth.RevokeDeviceActivation": {
-        input: AuthRevokeDeviceActivationInput;
-        output: AuthRevokeDeviceActivationOutput;
+    "Auth.Sessions.List": {
+        input: AuthSessionsListInput;
+        output: AuthSessionsListOutput;
     };
-    "Auth.RevokeSession": {
-        input: AuthRevokeSessionInput;
-        output: AuthRevokeSessionOutput;
+    "Auth.Sessions.Logout": {
+        input: AuthSessionsLogoutInput;
+        output: AuthSessionsLogoutOutput;
     };
-    "Auth.RevokeUserGrant": {
-        input: AuthRevokeUserGrantInput;
-        output: AuthRevokeUserGrantOutput;
+    "Auth.Sessions.Me": {
+        input: AuthSessionsMeInput;
+        output: AuthSessionsMeOutput;
     };
-    "Auth.SetDevicePortalDefault": {
-        input: AuthSetDevicePortalDefaultInput;
-        output: AuthSetDevicePortalDefaultOutput;
+    "Auth.Sessions.Revoke": {
+        input: AuthSessionsRevokeInput;
+        output: AuthSessionsRevokeOutput;
     };
-    "Auth.SetDevicePortalSelection": {
-        input: AuthSetDevicePortalSelectionInput;
-        output: AuthSetDevicePortalSelectionOutput;
+    "Auth.UserIdentities.List": {
+        input: AuthUserIdentitiesListInput;
+        output: AuthUserIdentitiesListOutput;
     };
-    "Auth.SetLoginPortalDefault": {
-        input: AuthSetLoginPortalDefaultInput;
-        output: AuthSetLoginPortalDefaultOutput;
+    "Auth.UserIdentities.Unlink": {
+        input: AuthUserIdentitiesUnlinkInput;
+        output: AuthUserIdentitiesUnlinkOutput;
     };
-    "Auth.SetLoginPortalSelection": {
-        input: AuthSetLoginPortalSelectionInput;
-        output: AuthSetLoginPortalSelectionOutput;
+    "Auth.Users.Create": {
+        input: AuthUsersCreateInput;
+        output: AuthUsersCreateOutput;
     };
-    "Auth.SetPortalProfile": {
-        input: AuthSetPortalProfileInput;
-        output: AuthSetPortalProfileOutput;
+    "Auth.Users.Get": {
+        input: AuthUsersGetInput;
+        output: AuthUsersGetOutput;
     };
-    "Auth.UnapplyDeviceDeploymentContract": {
-        input: AuthUnapplyDeviceDeploymentContractInput;
-        output: AuthUnapplyDeviceDeploymentContractOutput;
+    "Auth.Users.IdentityLink.Create": {
+        input: AuthUsersIdentityLinkCreateInput;
+        output: AuthUsersIdentityLinkCreateOutput;
     };
-    "Auth.UnapplyServiceDeploymentContract": {
-        input: AuthUnapplyServiceDeploymentContractInput;
-        output: AuthUnapplyServiceDeploymentContractOutput;
+    "Auth.Users.List": {
+        input: AuthUsersListInput;
+        output: AuthUsersListOutput;
     };
-    "Auth.UpdateUser": {
-        input: AuthUpdateUserInput;
-        output: AuthUpdateUserOutput;
+    "Auth.Users.Password.Change": {
+        input: AuthUsersPasswordChangeInput;
+        output: AuthUsersPasswordChangeOutput;
     };
-    "Auth.UpsertInstanceGrantPolicy": {
-        input: AuthUpsertInstanceGrantPolicyInput;
-        output: AuthUpsertInstanceGrantPolicyOutput;
+    "Auth.Users.PasswordReset.Create": {
+        input: AuthUsersPasswordResetCreateInput;
+        output: AuthUsersPasswordResetCreateOutput;
     };
-    "Auth.ValidateRequest": {
-        input: AuthValidateRequestInput;
-        output: AuthValidateRequestOutput;
+    "Auth.Users.Update": {
+        input: AuthUsersUpdateInput;
+        output: AuthUsersUpdateOutput;
     };
 }
-export type AuthApplyDeviceDeploymentContractHandler = RpcHandlerFn<typeof API.owned, "Auth.ApplyDeviceDeploymentContract">;
-export type AuthApplyServiceDeploymentContractHandler = RpcHandlerFn<typeof API.owned, "Auth.ApplyServiceDeploymentContract">;
-export type AuthClearDevicePortalSelectionHandler = RpcHandlerFn<typeof API.owned, "Auth.ClearDevicePortalSelection">;
-export type AuthClearLoginPortalSelectionHandler = RpcHandlerFn<typeof API.owned, "Auth.ClearLoginPortalSelection">;
-export type AuthCreateDeviceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.CreateDeviceDeployment">;
-export type AuthCreatePortalHandler = RpcHandlerFn<typeof API.owned, "Auth.CreatePortal">;
-export type AuthCreateServiceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.CreateServiceDeployment">;
-export type AuthDecideDeviceActivationReviewHandler = RpcHandlerFn<typeof API.owned, "Auth.DecideDeviceActivationReview">;
-export type AuthDisableDeviceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.DisableDeviceDeployment">;
-export type AuthDisableDeviceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.DisableDeviceInstance">;
-export type AuthDisableInstanceGrantPolicyHandler = RpcHandlerFn<typeof API.owned, "Auth.DisableInstanceGrantPolicy">;
-export type AuthDisablePortalHandler = RpcHandlerFn<typeof API.owned, "Auth.DisablePortal">;
-export type AuthDisablePortalProfileHandler = RpcHandlerFn<typeof API.owned, "Auth.DisablePortalProfile">;
-export type AuthDisableServiceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.DisableServiceDeployment">;
-export type AuthDisableServiceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.DisableServiceInstance">;
-export type AuthEnableDeviceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.EnableDeviceDeployment">;
-export type AuthEnableDeviceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.EnableDeviceInstance">;
-export type AuthEnableServiceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.EnableServiceDeployment">;
-export type AuthEnableServiceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.EnableServiceInstance">;
-export type AuthGetDeviceConnectInfoHandler = RpcHandlerFn<typeof API.owned, "Auth.GetDeviceConnectInfo">;
-export type AuthGetDevicePortalDefaultHandler = RpcHandlerFn<typeof API.owned, "Auth.GetDevicePortalDefault">;
-export type AuthGetInstalledContractHandler = RpcHandlerFn<typeof API.owned, "Auth.GetInstalledContract">;
-export type AuthGetLoginPortalDefaultHandler = RpcHandlerFn<typeof API.owned, "Auth.GetLoginPortalDefault">;
+export type AuthCapabilitiesListHandler = RpcHandlerFn<typeof API.owned, "Auth.Capabilities.List">;
+export type AuthCapabilityGroupsDeleteHandler = RpcHandlerFn<typeof API.owned, "Auth.CapabilityGroups.Delete">;
+export type AuthCapabilityGroupsGetHandler = RpcHandlerFn<typeof API.owned, "Auth.CapabilityGroups.Get">;
+export type AuthCapabilityGroupsListHandler = RpcHandlerFn<typeof API.owned, "Auth.CapabilityGroups.List">;
+export type AuthCapabilityGroupsPutHandler = RpcHandlerFn<typeof API.owned, "Auth.CapabilityGroups.Put">;
+export type AuthCatalogIssuesResolveHandler = RpcHandlerFn<typeof API.owned, "Auth.CatalogIssues.Resolve">;
+export type AuthConnectionsKickHandler = RpcHandlerFn<typeof API.owned, "Auth.Connections.Kick">;
+export type AuthConnectionsListHandler = RpcHandlerFn<typeof API.owned, "Auth.Connections.List">;
+export type AuthDeploymentsCreateHandler = RpcHandlerFn<typeof API.owned, "Auth.Deployments.Create">;
+export type AuthDeploymentsDisableHandler = RpcHandlerFn<typeof API.owned, "Auth.Deployments.Disable">;
+export type AuthDeploymentsEnableHandler = RpcHandlerFn<typeof API.owned, "Auth.Deployments.Enable">;
+export type AuthDeploymentsListHandler = RpcHandlerFn<typeof API.owned, "Auth.Deployments.List">;
+export type AuthDeploymentsRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.Deployments.Remove">;
+export type AuthDeviceUserAuthoritiesListHandler = RpcHandlerFn<typeof API.owned, "Auth.DeviceUserAuthorities.List">;
+export type AuthDeviceUserAuthoritiesReviewsDecideHandler = RpcHandlerFn<typeof API.owned, "Auth.DeviceUserAuthorities.Reviews.Decide">;
+export type AuthDeviceUserAuthoritiesReviewsListHandler = RpcHandlerFn<typeof API.owned, "Auth.DeviceUserAuthorities.Reviews.List">;
+export type AuthDeviceUserAuthoritiesRevokeHandler = RpcHandlerFn<typeof API.owned, "Auth.DeviceUserAuthorities.Revoke">;
+export type AuthDevicesConnectInfoGetHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.ConnectInfo.Get">;
+export type AuthDevicesDisableHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.Disable">;
+export type AuthDevicesEnableHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.Enable">;
+export type AuthDevicesListHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.List">;
+export type AuthDevicesProvisionHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.Provision">;
+export type AuthDevicesRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.Devices.Remove">;
+export type AuthEnvelopeExpansionsApproveHandler = RpcHandlerFn<typeof API.owned, "Auth.EnvelopeExpansions.Approve">;
+export type AuthEnvelopeExpansionsListHandler = RpcHandlerFn<typeof API.owned, "Auth.EnvelopeExpansions.List">;
+export type AuthEnvelopeExpansionsRejectHandler = RpcHandlerFn<typeof API.owned, "Auth.EnvelopeExpansions.Reject">;
+export type AuthEnvelopesChangesPreviewHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.Changes.Preview">;
+export type AuthEnvelopesExpandHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.Expand">;
+export type AuthEnvelopesGetHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.Get">;
+export type AuthEnvelopesGrantOverridesListHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.GrantOverrides.List">;
+export type AuthEnvelopesGrantOverridesPutHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.GrantOverrides.Put">;
+export type AuthEnvelopesGrantOverridesRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.GrantOverrides.Remove">;
+export type AuthEnvelopesListHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.List">;
+export type AuthEnvelopesShrinkHandler = RpcHandlerFn<typeof API.owned, "Auth.Envelopes.Shrink">;
 export type AuthHealthHandler = RpcHandlerFn<typeof API.owned, "Auth.Health">;
-export type AuthKickConnectionHandler = RpcHandlerFn<typeof API.owned, "Auth.KickConnection">;
-export type AuthListApprovalsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListApprovals">;
-export type AuthListConnectionsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListConnections">;
-export type AuthListDeviceActivationReviewsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListDeviceActivationReviews">;
-export type AuthListDeviceActivationsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListDeviceActivations">;
-export type AuthListDeviceDeploymentsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListDeviceDeployments">;
-export type AuthListDeviceInstancesHandler = RpcHandlerFn<typeof API.owned, "Auth.ListDeviceInstances">;
-export type AuthListDevicePortalSelectionsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListDevicePortalSelections">;
-export type AuthListInstalledContractsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListInstalledContracts">;
-export type AuthListInstanceGrantPoliciesHandler = RpcHandlerFn<typeof API.owned, "Auth.ListInstanceGrantPolicies">;
-export type AuthListLoginPortalSelectionsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListLoginPortalSelections">;
-export type AuthListPortalProfilesHandler = RpcHandlerFn<typeof API.owned, "Auth.ListPortalProfiles">;
-export type AuthListPortalsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListPortals">;
-export type AuthListServiceDeploymentsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListServiceDeployments">;
-export type AuthListServiceInstancesHandler = RpcHandlerFn<typeof API.owned, "Auth.ListServiceInstances">;
-export type AuthListSessionsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListSessions">;
-export type AuthListUserGrantsHandler = RpcHandlerFn<typeof API.owned, "Auth.ListUserGrants">;
-export type AuthListUsersHandler = RpcHandlerFn<typeof API.owned, "Auth.ListUsers">;
-export type AuthLogoutHandler = RpcHandlerFn<typeof API.owned, "Auth.Logout">;
-export type AuthMeHandler = RpcHandlerFn<typeof API.owned, "Auth.Me">;
-export type AuthProvisionDeviceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.ProvisionDeviceInstance">;
-export type AuthProvisionServiceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.ProvisionServiceInstance">;
-export type AuthRemoveDeviceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.RemoveDeviceDeployment">;
-export type AuthRemoveDeviceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.RemoveDeviceInstance">;
-export type AuthRemoveServiceDeploymentHandler = RpcHandlerFn<typeof API.owned, "Auth.RemoveServiceDeployment">;
-export type AuthRemoveServiceInstanceHandler = RpcHandlerFn<typeof API.owned, "Auth.RemoveServiceInstance">;
-export type AuthRevokeApprovalHandler = RpcHandlerFn<typeof API.owned, "Auth.RevokeApproval">;
-export type AuthRevokeDeviceActivationHandler = RpcHandlerFn<typeof API.owned, "Auth.RevokeDeviceActivation">;
-export type AuthRevokeSessionHandler = RpcHandlerFn<typeof API.owned, "Auth.RevokeSession">;
-export type AuthRevokeUserGrantHandler = RpcHandlerFn<typeof API.owned, "Auth.RevokeUserGrant">;
-export type AuthSetDevicePortalDefaultHandler = RpcHandlerFn<typeof API.owned, "Auth.SetDevicePortalDefault">;
-export type AuthSetDevicePortalSelectionHandler = RpcHandlerFn<typeof API.owned, "Auth.SetDevicePortalSelection">;
-export type AuthSetLoginPortalDefaultHandler = RpcHandlerFn<typeof API.owned, "Auth.SetLoginPortalDefault">;
-export type AuthSetLoginPortalSelectionHandler = RpcHandlerFn<typeof API.owned, "Auth.SetLoginPortalSelection">;
-export type AuthSetPortalProfileHandler = RpcHandlerFn<typeof API.owned, "Auth.SetPortalProfile">;
-export type AuthUnapplyDeviceDeploymentContractHandler = RpcHandlerFn<typeof API.owned, "Auth.UnapplyDeviceDeploymentContract">;
-export type AuthUnapplyServiceDeploymentContractHandler = RpcHandlerFn<typeof API.owned, "Auth.UnapplyServiceDeploymentContract">;
-export type AuthUpdateUserHandler = RpcHandlerFn<typeof API.owned, "Auth.UpdateUser">;
-export type AuthUpsertInstanceGrantPolicyHandler = RpcHandlerFn<typeof API.owned, "Auth.UpsertInstanceGrantPolicy">;
-export type AuthValidateRequestHandler = RpcHandlerFn<typeof API.owned, "Auth.ValidateRequest">;
+export type AuthIdentitiesGrantsListHandler = RpcHandlerFn<typeof API.owned, "Auth.Identities.Grants.List">;
+export type AuthIdentitiesListHandler = RpcHandlerFn<typeof API.owned, "Auth.Identities.List">;
+export type AuthIdentityEnvelopesRevokeHandler = RpcHandlerFn<typeof API.owned, "Auth.IdentityEnvelopes.Revoke">;
+export type AuthPortalsGetHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.Get">;
+export type AuthPortalsListHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.List">;
+export type AuthPortalsLoginSettingsGetHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.LoginSettings.Get">;
+export type AuthPortalsLoginSettingsUpdateHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.LoginSettings.Update">;
+export type AuthPortalsPutHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.Put">;
+export type AuthPortalsRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.Remove">;
+export type AuthPortalsRoutesPutHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.Routes.Put">;
+export type AuthPortalsRoutesRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.Portals.Routes.Remove">;
+export type AuthRequestsValidateHandler = RpcHandlerFn<typeof API.owned, "Auth.Requests.Validate">;
+export type AuthServiceInstancesDisableHandler = RpcHandlerFn<typeof API.owned, "Auth.ServiceInstances.Disable">;
+export type AuthServiceInstancesEnableHandler = RpcHandlerFn<typeof API.owned, "Auth.ServiceInstances.Enable">;
+export type AuthServiceInstancesListHandler = RpcHandlerFn<typeof API.owned, "Auth.ServiceInstances.List">;
+export type AuthServiceInstancesProvisionHandler = RpcHandlerFn<typeof API.owned, "Auth.ServiceInstances.Provision">;
+export type AuthServiceInstancesRemoveHandler = RpcHandlerFn<typeof API.owned, "Auth.ServiceInstances.Remove">;
+export type AuthSessionsListHandler = RpcHandlerFn<typeof API.owned, "Auth.Sessions.List">;
+export type AuthSessionsLogoutHandler = RpcHandlerFn<typeof API.owned, "Auth.Sessions.Logout">;
+export type AuthSessionsMeHandler = RpcHandlerFn<typeof API.owned, "Auth.Sessions.Me">;
+export type AuthSessionsRevokeHandler = RpcHandlerFn<typeof API.owned, "Auth.Sessions.Revoke">;
+export type AuthUserIdentitiesListHandler = RpcHandlerFn<typeof API.owned, "Auth.UserIdentities.List">;
+export type AuthUserIdentitiesUnlinkHandler = RpcHandlerFn<typeof API.owned, "Auth.UserIdentities.Unlink">;
+export type AuthUsersCreateHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.Create">;
+export type AuthUsersGetHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.Get">;
+export type AuthUsersIdentityLinkCreateHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.IdentityLink.Create">;
+export type AuthUsersListHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.List">;
+export type AuthUsersPasswordChangeHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.Password.Change">;
+export type AuthUsersPasswordResetCreateHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.PasswordReset.Create">;
+export type AuthUsersUpdateHandler = RpcHandlerFn<typeof API.owned, "Auth.Users.Update">;
 export interface EventMap {
-    "Auth.Connect": {
-        event: AuthConnectEvent;
+    "Auth.Connections.Closed": {
+        event: AuthConnectionsClosedEvent;
     };
-    "Auth.ConnectionKicked": {
-        event: AuthConnectionKickedEvent;
+    "Auth.Connections.Kicked": {
+        event: AuthConnectionsKickedEvent;
     };
-    "Auth.DeviceActivated": {
-        event: AuthDeviceActivatedEvent;
+    "Auth.Connections.Opened": {
+        event: AuthConnectionsOpenedEvent;
     };
-    "Auth.DeviceActivationApproved": {
-        event: AuthDeviceActivationApprovedEvent;
+    "Auth.DeviceUserAuthorities.Approved": {
+        event: AuthDeviceUserAuthoritiesApprovedEvent;
     };
-    "Auth.DeviceActivationRequested": {
-        event: AuthDeviceActivationRequestedEvent;
+    "Auth.DeviceUserAuthorities.Requested": {
+        event: AuthDeviceUserAuthoritiesRequestedEvent;
     };
-    "Auth.DeviceActivationReviewRequested": {
-        event: AuthDeviceActivationReviewRequestedEvent;
+    "Auth.DeviceUserAuthorities.Resolved": {
+        event: AuthDeviceUserAuthoritiesResolvedEvent;
     };
-    "Auth.Disconnect": {
-        event: AuthDisconnectEvent;
+    "Auth.DeviceUserAuthorities.ReviewRequested": {
+        event: AuthDeviceUserAuthoritiesReviewRequestedEvent;
     };
-    "Auth.SessionRevoked": {
-        event: AuthSessionRevokedEvent;
+    "Auth.Sessions.Revoked": {
+        event: AuthSessionsRevokedEvent;
     };
 }
+export interface FeedMap {
+}
 export interface SubjectMap {
 }
 //# sourceMappingURL=types.d.ts.map